Mozilla Firefox < 57.0.1 Multiple Vulnerabilities

low Nessus Network Monitor Plugin ID 700323

Synopsis

The remote host has a web browser installed that is vulnerable to multiple attack vectors.

Description

Versions of Mozilla Firefox earlier than 57.0.1 are unpatched for the following vulnerabilities :

- A flaw exists in the 'PerDocumentStyleDataImpl::visited_styles_enabled()' function in 'servo/components/style/gecko/data.rs'. The issue is triggered when handling the CSS ':visited' selector for a document being used as an SVG image. With a specially crafted web page, a context-dependent attacker disclose visited history information. (CVE-2017-7844)
- A flaw exists in the 'FactoryOp::CheckPermission()' function in 'dom/indexedDB/ActorsParent.cpp' that is triggered as a web worker in Private Browsing mode can write to IndexedDB. With a specially crafted web page, a context-dependent attacker can uniquely fingerprint a user even when browsing in Private Browsing mode. (CVE-2017-7843)

Solution

Upgrade to Firefox version 57.0.1 or later.

Plugin Details

Severity: Low

ID: 700323

Family: Web Clients

Published: 8/21/2018

Updated: 3/6/2019

Nessus ID: 105040

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.7

Temporal Score: 3.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 11/29/2017

Vulnerability Publication Date: 11/28/2017

Reference Information

CVE: CVE-2017-7843, CVE-2017-7844

BID: 102039

Detections

Analytics