CVE-2017-7756 — Mozilla: Use-after-free and use-after-scope logging XHR header errors (MFSA 2017-16)

Back Back to CVE browser

CRITICAL

Mozilla: Use-after-free and use-after-scope logging XHR header errors (MFSA 2017-16)

Published Jun 11, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 2.63%

Description

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <54
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <52.2
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <52.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<54

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<52.2

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<52.2

Red Hat Enterprise Linux 6

firefox-0:52.2.0-1.el6_9

Fixed · RHSA-2017:1440
Red Hat Enterprise Linux 6

thunderbird-0:52.2.0-1.el6_9

Fixed · RHSA-2017:1561
Red Hat Enterprise Linux 7

firefox-0:52.2.0-1.el7_3

Fixed · RHSA-2017:1440
Red Hat Enterprise Linux 7

thunderbird-0:52.2.0-1.el7_3

Fixed · RHSA-2017:1561

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	firefox-0:52.2.0-1.el6_9	Fixed	RHSA-2017:1440
Red Hat Enterprise Linux 6	thunderbird-0:52.2.0-1.el6_9	Fixed	RHSA-2017:1561
Red Hat Enterprise Linux 7	firefox-0:52.2.0-1.el7_3	Fixed	RHSA-2017:1440
Red Hat Enterprise Linux 7	thunderbird-0:52.2.0-1.el7_3	Fixed	RHSA-2017:1561

Remediation

No remediation recorded yet.

Metrics

2.63% 0.02631

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02631

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.63% (0.02631)	84.99th	v5 (v2026.06.15)
Jun 15, 2026	2.69% (0.02687)	83.86th	v5 (v2026.06.15)
Aug 29, 2025	1.97% (0.01973)	82.80th	v4 (v2025.03.14)
Mar 30, 2025	3.69% (0.03688)	86.83th	v4 (v2025.03.14)
Mar 29, 2025	6.94% (0.06938)	85.36th	v4 (v2025.03.14)
Mar 17, 2025	3.15% (0.03149)	86.03th	v4 (v2025.03.14)
Dec 12, 2024	0.65% (0.00651)	80.12th	v3 (v2023.03.01)
Apr 9, 2024	0.64% (0.00642)	78.90th	v3 (v2023.03.01)
Dec 12, 2023	0.64% (0.00642)	76.90th	v3 (v2023.03.01)
Nov 2, 2023	0.98% (0.00982)	81.79th	v3 (v2023.03.01)
Sep 3, 2023	0.72% (0.00717)	78.13th	v3 (v2023.03.01)
Mar 7, 2023	0.55% (0.00552)	74.03th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 4, 2022	1.54% (0.01537)	51.33th	v2 (v2022.01.01)
Feb 3, 2022	2.27% (0.02273)	50.89th	v5 (v2026.06.15)
Apr 14, 2021	2.27% (0.02273)	0.00th	v1

Weaknesses (1)

CWE-416

Use After Free

References (15)

http://www.securityfocus.com/bid/99057
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038689
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1440
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:1561
vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-7756
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1366595
x_refsource_CONFIRMIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1461258
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7756
https://www.cve.org/CVERecord?id=CVE-2017-7756
https://www.debian.org/security/2017/dsa-3881
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2017/dsa-3918
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7756
https://www.mozilla.org/security/advisories/mfsa2017-15/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-16/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-17/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/99057		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038689		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2017:1440		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:1561		vendor-advisoryx_refsource_REDHATThird Party Advisory
https://access.redhat.com/security/cve/CVE-2017-7756		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1366595		x_refsource_CONFIRMIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1461258		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7756
https://www.cve.org/CVERecord?id=CVE-2017-7756
https://www.debian.org/security/2017/dsa-3881		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2017/dsa-3918		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7756
https://www.mozilla.org/security/advisories/mfsa2017-15/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-16/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-17/		x_refsource_CONFIRMVendor Advisory