CVE-2017-5428

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.

• CWE-190

• http://rhn.redhat.com/errata/RHSA-2017-0558.htmlThird Party Advisory
• http://www.securityfocus.com/bid/96959Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038060Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-08/Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0558.htmlThird Party Advisory
• http://www.securityfocus.com/bid/96959Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1038060Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168Exploit, Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-08/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5420A "javascript:" url loaded by a malicious page can obfuscate…
• CVE-2017-5421A malicious site could spoof the contents of the print previ…
• CVE-2017-5422If a malicious site uses the "view-source:" protocol in a se…
• CVE-2017-5425The Gecko Media Plugin sandbox allows access to local files …
• CVE-2017-5426On Linux, if the secure computing mode BPF (seccomp-bpf) fil…
• CVE-2017-5427A non-existent chrome.manifest file will attempt to be loade…
• CVE-2017-5429Memory safety bugs were reported in Firefox 52, Firefox ESR …
• CVE-2017-5430Memory safety bugs were reported in Firefox 52, Firefox ESR …
• CVE-2017-5432A use-after-free vulnerability occurs during certain text in…
• CVE-2017-5433A use-after-free vulnerability in SMIL animation functions o…
• CVE-2017-5434A use-after-free vulnerability occurs when redirecting focus…
• CVE-2017-5435A use-after-free vulnerability occurs during transaction pro…