CVE-2017-7839
Published: 15 November 2017
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
firefox Launchpad, Ubuntu, Debian |
artful |
Released
(57.0+build4-0ubuntu0.17.10.5)
|
| bionic |
Released
(57.0.1+build2-0ubuntu1)
|
|
| trusty |
Released
(57.0+build4-0ubuntu0.14.04.4)
|
|
| upstream |
Released
(57.0)
|
|
| xenial |
Released
(57.0+build4-0ubuntu0.16.04.5)
|
|
| zesty |
Released
(57.0+build4-0ubuntu0.17.04.5)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |