CVE-2017-7837 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation12 documents5 sources
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
1.0%
top 23.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

SVG loaded through "" tags can use "" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox < 57.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/firefox< firefox 57.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 57
▶Ubuntumozilla/firefox< 57.0+build4-0ubuntu0.14.04.4+8
▶NVDmozilla/firefox56.0.2

🔴Vulnerability Details

6
GHSA
GHSA-7f82-h9r4-w4qw: SVG loaded through "" tags can use "" tags within the SVG data to set cookies for that page↗2022-05-14
▶
OSV
firefox regression↗2018-01-03
▶
OSV
firefox regressions↗2017-12-01
▶
OSV
firefox regression↗2017-11-27
▶
OSV
firefox vulnerabilities↗2017-11-16
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2018-01-03
▶
Ubuntu
Firefox regressions↗2017-12-01
▶
Ubuntu
Firefox regression↗2017-11-27
▶
Ubuntu
Firefox vulnerabilities↗2017-11-16
▶
Debian
CVE-2017-7837: firefox - SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set...↗2017
▶