CVE-2017-7843

Name
CVE-2017-7843
Description
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Issue Tracking http://www.securityfocus.com/bid/102039
Third Party Advisory http://www.securityfocus.com/bid/102112
Third Party Advisory http://www.securitytracker.com/id/1039954
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3382
Exploit https://bugzilla.mozilla.org/show_bug.cgi?id=1410106
Third Party Advisory https://lists.debian.org/debian-lts-announce/2017/12/msg00003.html
Third Party Advisory https://www.debian.org/security/2017/dsa-4062
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2017-27/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2017-28/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* debian_linux == None == 7.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* debian_linux == None == 8.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* debian_linux == None == 9.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
firefox-esr edge-community 52.5.2-r0 None fixed
firefox-esr 3.22-community 52.5.2-r0 None fixed
firefox-esr 3.21-community 52.5.2-r0 None fixed
firefox-esr 3.20-community 52.5.2-r0 None fixed
firefox-esr 3.19-community 52.5.2-r0 None fixed
firefox-esr 3.18-community 52.5.2-r0 None fixed
firefox-esr 3.17-community 52.5.2-r0 None fixed