If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 11, 2018 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfo | Apr 21, 2017 | Apr 20, 2017 |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Apr 20, 2017 | Apr 19, 2017 | |
| Mfsa2017 10 | mozilla-firefox-upgrade-53_0 | Jul 12, 2018 | Jun 11, 2018 | |
| Mfsa2017 12 | mozilla-firefox-esr-upgrade-52_1 | Apr 20, 2017 | Apr 19, 2017 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-52_1 | May 2, 2017 | Apr 30, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-entire-11-4-11-4-0-0-1-15-0 | Oct 19, 2018 | Jun 11, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Apr 20, 2017 | Apr 19, 2017 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginfo | Apr 20, 2017 | Apr 20, 2017 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-slesuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-debuginfosuse-upgrade-mozillafirefox-debugsourcesuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-debuginfosuse-upgrade-mozillathunderbird-debugsourcesuse-upgrade-mozillathunderbird-develsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Apr 24, 2017 | Apr 20, 2017 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Apr 21, 2017 | Apr 20, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub