A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier releases are not affected. This vulnerability affects Firefox < 57.0.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefox-esrUpgrade firefoxUpgrade waterfoxUpgrade linux-seamonkeyUpgrade seamonkeyUpgrade linux-firefox | Dec 6, 2017 | Dec 5, 2017 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Feb 20, 2018 | Feb 20, 2018 |
| Mfsa2017 27 | — | Upgrade to Mozilla Firefox version 57.0.1 | Dec 5, 2017 | Nov 29, 2017 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-common | May 19, 2018 | Nov 29, 2017 |
| Ubuntu | — | Upgrade firefox | Nov 19, 2024 | Jun 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub