CVE-2017-7842 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information Exposure12 documents5 sources
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
0.4%
top 41.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "" elements instead of one. One of these requests includes the referrer instead of respecting the set policy to not include a referrer on requests. This vulnerability affects Firefox < 57.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶debiandebian/firefox< firefox 57.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 57
▶Ubuntumozilla/firefox< 57.0+build4-0ubuntu0.14.04.4+8
▶NVDmozilla/firefox56.0.2

🔴Vulnerability Details

6
GHSA
GHSA-9897-h6f7-gvh5: If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "" elements instead of one↗2022-05-14
▶
OSV
firefox regression↗2018-01-03
▶
OSV
firefox regressions↗2017-12-01
▶
OSV
firefox regression↗2017-11-27
▶
OSV
firefox vulnerabilities↗2017-11-16
▶

📋Vendor Advisories

5
Ubuntu
Firefox regression↗2018-01-03
▶
Ubuntu
Firefox regressions↗2017-12-01
▶
Ubuntu
Firefox regression↗2017-11-27
▶
Ubuntu
Firefox vulnerabilities↗2017-11-16
▶
Debian
CVE-2017-7842: firefox - If a document's Referrer Policy attribute is set to "no-referrer" sometimes two ...↗2017
▶