A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier releases are not affected. This vulnerability affects Firefox < 57.0.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-firefoxUpgrade seamonkeyUpgrade firefoxUpgrade linux-seamonkeyUpgrade waterfoxUpgrade firefox-esr | Dec 6, 2017 | Dec 5, 2017 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Feb 20, 2018 | Feb 20, 2018 |
| Mfsa2017 27 | — | Upgrade to Mozilla Firefox version 57.0.1Upgrade to the latest version of Mozilla Firefox | Dec 5, 2017 | Nov 29, 2017 |
| Suse | — | Upgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox | May 19, 2018 | Nov 29, 2017 |
| Ubuntu | — | Upgrade firefox | Nov 19, 2024 | Jun 11, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub