CVE-2017-7820 — Mozilla Firefox vulnerability

8 documents5 sources
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
0.8%
top 25.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 13

Description

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects Firefox < 56.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/firefox< firefox 56.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 56
▶Ubuntumozilla/firefox< 56.0+build6-0ubuntu0.14.04.1+4
▶NVDmozilla/firefox55.0.3

🔴Vulnerability Details

4
GHSA
GHSA-hq9m-2fcc-v974: The "instanceof" operator can bypass the Xray wrapper mechanism↗2022-05-13
▶
OSV
firefox regression↗2017-10-04
▶
OSV
CVE-2017-7820: The "instanceof" operator can bypass the Xray wrapper mechanism↗2017-10-02
▶
OSV
firefox vulnerabilities↗2017-10-02
▶

📋Vendor Advisories

3
Ubuntu
Firefox regression↗2017-10-04
▶
Ubuntu
Firefox vulnerabilities↗2017-10-02
▶
Debian
CVE-2017-7820: firefox - The "instanceof" operator can bypass the Xray wrapper mechanism. When called on ...↗2017
▶