LiveActive security incident?Get immediate response
CVE Record

CVE-2017-5465: An out-of-bounds read while processing SVG content in "ConvolvePixel".

An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2017-5465 is a Mozilla SVG-processing flaw that can crash affected clients and may expose memory by copying otherwise inaccessible data into rendered SVG content. It affects older Firefox, Firefox ESR, and Thunderbird versions. The main business risk is legacy browser or mail-client exposure to untrusted SVG or web content.

Executive priority

Treat this as a legacy-software cleanup priority rather than a current mass-exploitation emergency. Systems still using affected Mozilla versions should be updated or retired because the flaw can leak memory and has public exploit references.

Technical view

The flaw is an out-of-bounds read in SVG handling, specifically while processing content in ConvolvePixel. Mozilla lists affected versions as Thunderbird before 52.1, Firefox ESR before 45.9 and 52.1, and Firefox before 53. The described impact is crash plus potential memory disclosure into SVG graphic output.

Likely exposure

Exposure is most likely in unmanaged legacy endpoints, frozen virtual desktops, embedded kiosk images, or old Linux distributions still running affected Mozilla builds. Modern supported Firefox and Thunderbird versions should not be assumed affected based on these sources.

Exploitation context

The source bundle includes an Exploit-DB reference, so public exploit material existed. However, the CVE is not listed as KEV in the bundle, and no provided source establishes active exploitation in the wild.

Researcher notes

Evidence supports an SVG-triggered out-of-bounds read with crash and potential memory disclosure. The bundle does not provide CVSS, CWE, exploit-in-the-wild confirmation, or detailed patch mechanics. Avoid inferring code execution from the available description.

Mitigation direction

  • Upgrade Firefox, Firefox ESR, and Thunderbird beyond the affected version ranges.
  • Apply relevant Mozilla, Debian, or Red Hat security updates for managed systems.
  • Remove or isolate unsupported legacy Mozilla clients from business networks.
  • Restrict exposure to untrusted SVG content where immediate upgrade is impossible.
  • Check vendor advisories for platform-specific package names and fixed builds.

Validation and detection

  • Inventory Firefox, Firefox ESR, and Thunderbird versions across endpoints.
  • Confirm no Thunderbird versions below 52.1 remain in use.
  • Confirm no Firefox versions below 53 remain in use.
  • Confirm Firefox ESR is at least 45.9 or 52.1, as applicable.
  • Review package manager history for the referenced Debian or Red Hat advisories.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-5465 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
11Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MozillaThunderbirdunspecifiedListed
MozillaFirefox ESRunspecified, unspecifiedListed
MozillaFirefoxunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.