CVEvulnerability
CVE-2017-7843
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Affected configurations
• debian debian linux 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• mozilla firefox (< 57.0.1)
• mozilla firefox (< 52.5.2)
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server eus 7.4
• redhat enterprise linux server eus 7.5
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.securityfocus.com/bid/102039 Issue Tracking, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/102112 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039954 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:3382 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1410106 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00003.html Third Party Advisory
- https://www.debian.org/security/2017/dsa-4062 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-27/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-28/ Vendor Advisory
- http://www.securityfocus.com/bid/102039 Issue Tracking, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/102112 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1039954 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:3382 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1410106 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/12/msg00003.html Third Party Advisory
- https://www.debian.org/security/2017/dsa-4062 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-27/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-28/ Vendor Advisory