CVE-2017-7844 - A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history

Back Back to CVE browser

MEDIUM

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history

Published Jun 11, 2018

6.5

MEDIUM

CVSS 3.0

EPSS 1.75%

Description

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier releases are not affected. This vulnerability affects Firefox < 57.0.1.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <57.0.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<57.0.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (5)

http://www.securityfocus.com/bid/102039
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039954
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1420001
x_refsource_CONFIRMIssue TrackingPermissions RequiredThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16819
Advisory
https://www.mozilla.org/security/advisories/mfsa2017-27/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/102039		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039954		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1420001		x_refsource_CONFIRMIssue TrackingPermissions RequiredThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-16819		Advisory
https://www.mozilla.org/security/advisories/mfsa2017-27/		x_refsource_CONFIRMVendor Advisory