{"id":"CVE-2017-5471","aliases":["EUVD-2017-14575","GHSA-jgj7-qr7v-4334","UBUNTU-CVE-2017-5471","USN-3315-1"],"status":"published","title":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory...","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01864,"percentile":0.79402,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-06-14T00:00:00Z","modified":"2026-06-17T01:20:34Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"firefox","fixed_in":["54.0+build3-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"firefox","fixed_in":["54.0+build3-0ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"54.0+build3-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.2","52.0+build2-0ubuntu0.14.04.1","52.0.1+build2-0ubuntu0.14.04.1","52.0.2+build1-0ubuntu0.14.04.1","53.0+build6-0ubuntu0.14.04.1","53.0.2+build1-0ubuntu0.14.04.2","53.0.3+build1-0ubuntu0.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"54.0+build3-0ubuntu0.16.04.1"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"54.0+build3-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.2","52.0+build2-0ubuntu0.14.04.1","52.0.1+build2-0ubuntu0.14.04.1","52.0.2+build1-0ubuntu0.14.04.1","53.0+build6-0ubuntu0.14.04.1","53.0.2+build1-0ubuntu0.14.04.2","53.0.3+build1-0ubuntu0.14.04.2"],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"54.0+build3-0ubuntu0.16.04.1"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2"],"bundled":21}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"http://www.securityfocus.com/bid/99042","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-15/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1038689","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.mozilla.org/buglist.cgi?bug_id=1349604%2C1318645%2C1361098%2C1361100%2C1341026%2C1349421%2C1360852%2C1299147%2C1352073%2C1354853%2C1366446%2C1342181%2C1343069","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5471"},{"url":"https://github.com/advisories/GHSA-jgj7-qr7v-4334"},{"url":"https://ubuntu.com/security/CVE-2017-5471","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3315-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-5471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7751","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7752","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7754","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7757","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7758","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7762","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7764","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7771","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7772","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7773","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7775","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7776","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7777","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7778","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5471","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T15:04:14.637Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14575","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T15:04:14Z","updated_at":"2026-11-03T02:39:15.385305Z"}],"ghsa":[{"id":"GHSA-jgj7-qr7v-4334","title":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory...","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","status":"published","published":"2022-05-14T03:09:03Z","modified":"2023-02-02T05:07:39Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:33.427724Z"}],"nvd":[{"id":"CVE-2017-5471","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","status":"published","published":"2018-06-11T21:29:07.577Z","modified":"2026-06-17T01:20:34.013Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"UBUNTU-CVE-2017-5471","description":"Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 54.","status":"published","published":"2017-06-14T00:00:00Z","modified":"2026-04-22T11:27:24.803876Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:15.388065Z"},{"id":"USN-3315-1","title":"firefox vulnerabilities","description":"Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, read uninitialized\nmemory, obtain sensitive information, spoof the addressbar contents, or\nexecute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472,\nCVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,\nCVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)\n\nMultiple security issues were discovered in the Graphite 2 library used by\nFirefox. If a user were tricked in to opening a specially crafted website,\nan attacker could potentially exploit these to cause a denial of service,\nread uninitialized memory, or execute arbitrary code. (CVE-2017-7771,\nCVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776,\nCVE-2017-7777, CVE-2017-7778)\n","status":"published","published":"2017-06-15T11:46:10Z","modified":"2026-04-22T09:36:29.694721Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}