LiveActive security incident?Get immediate response
CVE Record

CVE-2017-7756: A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (...

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is an old Mozilla memory-safety flaw that could crash Firefox or Thunderbird when handling XHR header error logging. The public bundle says the crash was potentially exploitable, but does not prove active exploitation. Risk is mainly for organizations still running Firefox before 54, Firefox ESR before 52.2, or Thunderbird before 52.2.

Executive priority

Address during legacy software cleanup unless vulnerable versions are still in active user workflows. If found in production, prioritize removal because browser and email clients process untrusted content.

Technical view

CVE-2017-7756 is described as a use-after-free and use-after-scope issue in error logging for XMLHttpRequest headers. Affected products are Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2. The bundle provides no CVSS score or CWE, but Mozilla, Debian, and Red Hat advisories indicate vendor-tracked fixes existed.

Likely exposure

Exposure is likely limited to legacy desktops, servers with packaged browser components, or long-retired Thunderbird installations. Modern maintained Mozilla releases should not be affected based on the stated version boundaries.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The strongest public statement in the bundle is that the crash was potentially exploitable. Treat exploitation status as unconfirmed.

Researcher notes

The bundle does not include CVSS, exploit details, or a root-cause patch diff. Focus validation on version evidence and vendor advisory mapping. Avoid assuming remote code execution beyond the source language of a potentially exploitable crash.

Mitigation direction

  • Upgrade Firefox to version 54 or later where applicable.
  • Upgrade Firefox ESR to version 52.2 or later where applicable.
  • Upgrade Thunderbird to version 52.2 or later where applicable.
  • Apply Debian or Red Hat advisory updates for packaged Mozilla products.
  • Retire unsupported legacy Mozilla installations where updates are unavailable.

Validation and detection

  • Inventory Firefox, Firefox ESR, and Thunderbird versions across managed assets.
  • Flag Firefox versions below 54 as affected.
  • Flag Firefox ESR and Thunderbird versions below 52.2 as affected.
  • Check Linux package advisory status against Debian and Red Hat bulletins.
  • Confirm exception handling for any legacy systems that cannot be upgraded.
Prepared
Confidence
high
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2017-7756 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MozillaFirefoxunspecifiedListed
MozillaFirefox ESRunspecifiedListed
MozillaThunderbirdunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.