Segmentation fault in Mozilla Firefox - CVE-2017-5406
Published: March 7, 2017
Vulnerability identifier: #VU5926
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5406
CWE-ID: CWE-665
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause denial of service attack.
The vulnerability exists due in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger segmentation fault and cause denial of service attack.
Successful exploitation of the vulnerability may allow an attacker to crash the victim’s browser.
Affected software
Mozilla Firefox
How to mitigate CVE-2017-5406
Update to Firefox 52.