#CVE-2017-7752: Use-after-free with IME input Reporter Nils Impact moderate DescriptionĪ use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled.
Note: This attack only affects Windows operating systems. This allows privileged execution if the installer is run with elevated privileges. The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. #CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files Reporter Yuji Tounai of NTT Communications, Eili Masami of Tachibana Lab Impact high Description #CVE-2017-7751: Use-after-free with content viewer listeners Reporter Nils Impact high DescriptionĪ use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This results in a potentially exploitable crash. #CVE-2017-7750: Use-after-free with track elements Reporter Nils Impact high DescriptionĪ use-after-free vulnerability during video control operations when a element holds a reference to an older window if that window has been replaced in the DOM. #CVE-2017-7749: Use-after-free during docshell reloading Reporter Nils Impact high DescriptionĪ use-after-free vulnerability when using an incorrect URL during the reloading of a docshell.
#CVE-2017-5472: Use-after-free using destroyed node when regenerating trees Reporter Nils Impact critical DescriptionĪ use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. Mozilla Foundation Security Advisory 2017-17 Security vulnerabilities fixed in Thunderbird 52.2 Announced JImpact critical Products Thunderbird Fixed in