CVE-2017-5379: Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing

Recommended actionWithin 7 days

High technical severity with public exploit material referenced by a structured source; prioritise exposed affected systems while verifying vendor guidance.

Fix not verified

What, why and how

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51.

What

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51.

Why

The program can continue using memory after it has been released, producing unsafe and attacker-influenceable behaviour.

How

An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51.

Why

The program can continue using memory after it has been released, producing unsafe and attacker-influenceable behaviour.

How

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material

Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.

Reference recorded

A structured CVE source labels at least one public reference as exploit material. BlackTree has not independently validated that it is safe, reliable or weaponised.

Likely attack path: a network path → Use After Free → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface: Network
Privileges required: None: unauthenticated exploitation is possible
User interaction: None
Attack complexity: Low: no specialised conditions are recorded
Security boundary: Unchanged: impact remains within the vulnerable component's security authority
Weakness ? CWE means Common Weakness Enumeration: a standard category for the underlying weakness.: CWE-416 ↗
CWE-416: Use After Free. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
CVSS vector ? CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Common Vulnerability Scoring System 3.0: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CNoneConfidentiality impact: No direct loss is represented by this metric.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land: No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.

NetworkUnauthenticatedCWE-416Public exploit reference

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

ENISA EUVD · EUVD-2017-14483Official EUVD mapping

0 linked advisory records.

Official EUVD record ↗

Canadian Centre for Cyber Security · English · AV17-013Mozilla Releases security updates

Number: AV17-013 Date: 25 January 2017 Purpose The purpose of this advisory is to raise awareness of multiple vulnerabilities in Mozilla Firefox and Firefox ESR for which updates are now available. Assessment Mozilla released security updates to address 24 vulnerabilities in Firefox and Firefox ESR. The severity of these issues ranges from low to critical. Versions affected: Firefox versions prior to 51 ESR versions prior to 45.7 CVE References: CVE-2017-5373, CVE-2017-5374, CVE-2017-5375, CVE-2017-5376, CVE-2017-5377, CVE-2017-5378, CVE-2017-5379, CVE-2017-5380, CVE-2017-5381, CVE-2017-5382, CVE-2017-5383, CVE-2017-5384, CVE-2017-5385, CVE-2017-5386, CVE-2017-5387, CVE-2017-5388, CVE-2017-5389, CVE-2017-5390, CVE-2017-5391, CVE-2017-5392, CVE-2017-5393, CVE-2017-5394, CVE-2017-5395, CVE-2017-5396 Suggested Action CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly. References: https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/

Official advisory ↗

CERT-FR · French · CERTFR-2017-AVI-029Multiples vulnérabilités dans Mozilla Firefox

https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/ Bulletin de sécurité Mozilla mfsa2017-02 du 24 janvier 2017 https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ Référence CVE CVE-2017-5373 https://www.cve.org/CVERecord?id=CVE-2017-5373 Référence CVE CVE-2017-5374 https://www.cve.org/CVERecord?id=CVE-2017-5374 Référence CVE CVE-2017-5375 https://www.cve.org/CVERecord?id=CVE-2017-5375 Référence CVE CVE-2017-5376 https://www.cve.org/CVERecord?id=CVE-2017-5376 Référence CVE CVE-2017-5377 https://www.cve.org/CVERecord?id=CVE-2017-5377 Référence CVE CVE-2017-5378 https://www.cve.org/CVERecord?id=CVE-2017-5378 Référence CVE CVE-2017-5379 https://www.cve.org/CVERecord?id=CVE-2017-5379 Référence CVE CVE-2017-5380 https://www.cve.org/CVERecord?id=CVE-2017-5380 Référence CVE CVE-2017-5381 https://www.cve.org/CVERecord?id=CVE-2017-5381 Référence CVE CVE-2017-5382 https://www.cve.org/CVERecord?id=CVE-2017-5382 Référence CVE CVE-2017-5383 https://www.cve.org/CVERecord?id=CVE-2017-5383 Référence CVE CVE-2017-5384 https://www.cve.org/CVERecord?id=CVE-2017-5384 Référence CVE CVE-2017-5385 https://www.cve.org/CVERecord?id=CVE-2017-5385 Référence CVE CVE-2017-5386 https://www.cve.org/CVERecord?id=CVE-2017-5386 Référence CVE CVE-2017-5387 https://www.cve.org/CVERecord?id=CVE-2017-5387 Ré

Official advisory ↗

JVN iPedia · Japanese · JVNDB-2017-013955Firefox における解放済みメモリの使用に関する脆弱性

Firefox には、解放済みメモリの使用に関する脆弱性が存在します。

Official advisory ↗

Patch and workaround

Operational remediation based on structured source evidence.

Status ? Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.: Fix not verified
Affected: Firefox: unspecified < 51
Fixed: No fixed version is explicitly recorded in the structured CVE data.
Action: No verified patch reference is present in the current structured sources. Check the vendor advisory before making a change.
Workaround: No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.

Evidence and provenance

Published 11 Jun 2018 · Last source change 5 Aug 2024, 14:55 UTC · CWE-416 · Use After Free

CVE recordCVE.org · 5.1

CVSS sourceNIST NVD

EPSS source

The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.

FIRST · tracked since 2026-09-01

European sourceENISA EUVD · EUVD-2017-14483

Product sourceCNA

Remediation sourceCVE/CNA references

CWE sourceNIST NVD

NVD statusNVD modified after enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates ↗

5 Aug 2024, 14:55 UTC
Vendor guidanceAuthoritative vendor guidance changed from no authoritative guidance recorded to vendor advisory.
Before
no authoritative guidance recorded
After
vendor advisory
af854a3a-2127-422b-91ae-364da2661108 ↗
5 Aug 2024, 14:55 UTC
Public exploit evidencePublic exploit evidence changed from No public exploit to Public exploit reference.
Before
No public exploit
After
Public exploit reference
af854a3a-2127-422b-91ae-364da2661108 ↗
5 Aug 2024, 14:55 UTC
SeveritySeverity changed from Unknown to High.
Before
Unknown
After
High
NIST NVD ↗
5 Aug 2024, 14:55 UTC
CVSS scoreCVSS score changed from not recorded to 7.5 (CVSS 3.0 · NIST NVD · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Before
not recorded
After
7.5 (CVSS 3.0 · NIST NVD · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
NIST NVD ↗
1 Sept 2026, 02:42 UTC
ENISA EUVD mappingEUVD-2017-14483 was added to the official ENISA EUVD mapping for this CVE.
Before
not recorded
After
{"euvdId":"EUVD-2017-14483"}
ENISA EUVD ↗
5 Aug 2024, 14:55 UTC
Catalogue recordCVE added to the BlackTree catalogue.
CNA ↗

2018-06-11CVE published

ENISA EUVD · EUVD-2017-14483↗Public exploit reference↗Vendor advisory↗Official CVE record (CNA and ADP data)↗NVD record↗

Technical terms and abbreviations used in this report

CVE: Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS: Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS: Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE: Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA: CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP: Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD: National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT: A computer security incident response team that publishes warnings or coordinates incident response.
PoC: Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF: Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL: Living off the land: abuse of legitimate tools or system functions during an attack.

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

ENISA European Vulnerability Database

EUVD-2017-14483

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

What changed after publication

Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing

National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

EUVD-2017-14483

What, why and how

Exploit reality and attack path

Official authority intelligence

Patch and workaround

Evidence and provenance

National CERT insights
?
CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.