When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esr | Jun 11, 2018 | Jun 11, 2018 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfo | Dec 7, 2017 | Dec 5, 2017 |
| Debian | debian-upgrade-firefox-esr | Dec 12, 2017 | Dec 5, 2017 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-waterfoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefox | Dec 6, 2017 | Dec 5, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Feb 20, 2018 | Feb 20, 2018 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-firefox | Jan 18, 2018 | Dec 4, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-firefox | Jan 18, 2018 | Dec 4, 2017 | |
| Mfsa2017 27 | mozilla-firefox-upgrade-57_0_1 | Dec 5, 2017 | Nov 29, 2017 | |
| Mfsa2017 28 | mozilla-firefox-esr-upgrade-52_5_2 | Dec 8, 2017 | Dec 7, 2017 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-browser-firefox-52-5-2-0-175-3-28-0-2-0oracle-solaris-11-3-upgrade-web-browser-firefox-plugin-firefox-java-52-5-2-0-175-3-28-0-2-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-52-5-2-0-175-3-28-0-2-0 | Feb 6, 2018 | Feb 6, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-firefox | Dec 5, 2017 | Dec 4, 2017 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginfo | Dec 5, 2017 | Dec 4, 2017 |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-other | Dec 12, 2017 | Dec 5, 2017 |
| Ubuntu | ubuntu-upgrade-firefox | Nov 19, 2024 | Jun 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub