CVE-2017-5419

If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the operating system. This is a denial of service (DOS) attack. This vulnerability affects Firefox < 52 and Thunderbird < 52.

• http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312243Exploit, Issue Tracking, Patch
• https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory
• http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1312243Exploit, Issue Tracking, Patch
• https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5413A segmentation fault can occur during some bidirectional lay…
• CVE-2017-5414The file picker dialog can choose and display the wrong loca…
• CVE-2017-5415An attack can use a blob URL and script to spoof an arbitrar…
• CVE-2017-5416In certain circumstances a networking event listener can be …
• CVE-2017-5417When dragging content from the primary browser pane to the a…
• CVE-2017-5418An out of bounds read error occurs when parsing some HTTP di…
• CVE-2017-5420A "javascript:" url loaded by a malicious page can obfuscate…
• CVE-2017-5421A malicious site could spoof the contents of the print previ…
• CVE-2017-5422If a malicious site uses the "view-source:" protocol in a se…
• CVE-2017-5425The Gecko Media Plugin sandbox allows access to local files …
• CVE-2017-5426On Linux, if the secure computing mode BPF (seccomp-bpf) fil…
• CVE-2017-5427A non-existent chrome.manifest file will attempt to be loade…