CVE-2017-7839
Publication date 15 November 2017
Last updated 24 July 2024
Ubuntu priority
Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 57.0.1+build2-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 57.0+build4-0ubuntu0.16.04.5
|
|
| 14.04 LTS trusty |
Fixed 57.0+build4-0ubuntu0.14.04.4
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.1 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality | Low |
| Integrity impact | Low |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3477-1
- Firefox vulnerabilities
- 16 November 2017