When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefox-esr | Jun 11, 2018 | Jun 11, 2018 |
| Centos_linux | — | Upgrade firefoxUpgrade firefox-debuginfo | Dec 7, 2017 | Dec 5, 2017 |
| Debian | — | Upgrade firefox-esr | Dec 12, 2017 | Dec 5, 2017 |
| Freebsd | — | Upgrade linux-seamonkeyUpgrade linux-firefoxUpgrade waterfoxUpgrade seamonkeyUpgrade firefoxUpgrade firefox-esr | Dec 6, 2017 | Dec 5, 2017 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Feb 20, 2018 | Feb 20, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade firefox | Jan 18, 2018 | Dec 4, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade firefox | Jan 18, 2018 | Dec 4, 2017 |
| Mfsa2017 27 | — | Upgrade to Mozilla Firefox version 57.0.1 | Dec 5, 2017 | Nov 29, 2017 |
| Mfsa2017 28 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 52.5.2 | Dec 8, 2017 | Dec 7, 2017 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 52.5.2-0.175.3.28.0.2.0 on Solaris 11.3Upgrade web/browser/firefox to version 52.5.2-0.175.3.28.0.2.0 on Solaris 11.3Upgrade web/browser/firefox/plugin/firefox-java to version 52.5.2-0.175.3.28.0.2.0 on Solaris 11.3 | Feb 6, 2018 | Feb 6, 2018 |
| Oracle_linux | — | Upgrade firefox | Dec 5, 2017 | Dec 4, 2017 |
| Redhat_linux | — | Upgrade firefoxUpgrade firefox-debuginfo | Dec 5, 2017 | Dec 4, 2017 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-devel | Dec 12, 2017 | Dec 5, 2017 |
| Ubuntu | — | Upgrade firefox | Nov 19, 2024 | Jun 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub