CVE-2017-7843
Description
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
1.058
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2017-7843,CVE-2017-7844 are fixed in Update for Mozilla Firefox For Mac (57.0.1) | Mac |
| Vulnerabilities CVE-2017-7843 are affected in Firefox ESR for Mac 52.5.0 | Mac |
| Vulnerabilities CVE-2017-7843 are affected in Mozilla Firefox for Mac 52.5.0 | Mac |
| Vulnerabilities CVE-2017-7843,CVE-2017-7844 are affected in Mozilla Firefox for Mac 57.0 | Mac |
| Vulnerabilities CVE-2017-7843 are fixed in Mozilla Firefox For Mac 52.5.2 | Mac |
| firefox-esr security update(DSA-4062-1) firefox-esr_52.5.2esr-1~deb9u1_i386.deb | Linux |
| firefox-esr security update(DSA-4062-1) firefox-esr_52.5.2esr-1~deb9u1_amd64.deb | Linux |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-607000 | Mozilla Firefox For Mac (124.0) |
| PATCH-611808 | Mozilla Firefox ESR for MAC 128.14.0 |
| PATCH-611870 | Mozilla Firefox For Mac (142.0.1) |
| PATCH-611870 | Mozilla Firefox For Mac (142.0.1) |
| PATCH-612783 | Mozilla Firefox For Mac (145.0.1) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234