A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-firefox-esr | Sep 20, 2017 | Mar 13, 2017 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 11, 2018 |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfo | Mar 9, 2017 | Mar 7, 2017 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-icedove | Mar 11, 2017 | Mar 7, 2017 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Mar 8, 2017 | Mar 7, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 30, 2017 | May 9, 2017 | |
| Mfsa2017 05 | mozilla-firefox-upgrade-52_0 | Mar 8, 2017 | Mar 7, 2017 | |
| Mfsa2017 06 | mozilla-firefox-esr-upgrade-45_8 | Mar 8, 2017 | Mar 7, 2017 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-52_0 | Mar 8, 2017 | Mar 7, 2017 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-mail-thunderbird-45-8-0-0-175-3-20-0-3-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-45-8-0-0-175-3-20-0-2-0oracle-solaris-11-3-upgrade-web-browser-firefox-45-8-0-0-175-3-19-0-2-0oracle-solaris-11-3-upgrade-web-browser-firefox-plugin-firefox-java-45-8-0-0-175-3-19-0-2-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-45-8-0-0-175-3-19-0-2-0 | May 29, 2017 | May 29, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Mar 9, 2017 | Mar 7, 2017 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginfo | Mar 11, 2017 | Mar 7, 2017 |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-develsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Mar 15, 2017 | Mar 7, 2017 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Mar 8, 2017 | Mar 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub