- Home
- CVEs with nessus.description==USN-3477-1 fixed vulnerabilities in Firefox. The update introduced a
crash reporting issue where background tab crash reports were sent to
Mozilla without user opt-in. This update fixes the problem.
We apologize for the inconvenience.
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read
uninitialized memory, obtain sensitive information, bypass same-origin
restrictions, bypass CSP protections, bypass mixed content blocking,
spoof the addressbar, or execute arbitrary code. (CVE-2017-7826,
CVE-2017-7827, CVE-2017-7828, CVE-2017-7830, CVE-2017-7831,
CVE-2017-7832, CVE-2017-7833, CVE-2017-7834, CVE-2017-7835,
CVE-2017-7837, CVE-2017-7838, CVE-2017-7842)
It was discovered that javascript: URLs pasted in to the
addressbar would be executed instead of being blocked in
some circumstances. If a user were tricked in to copying a
specially crafted URL in to the addressbar, an attacker
could potentially exploit this to conduct cross-site
scripting (XSS) attacks. (CVE-2017-7839)
It was discovered that exported bookmarks do not strip
script elements from user-supplied tags. If a user were
tricked in to adding specially crafted tags to bookmarks,
exporting them and then opening the resulting HTML file, an
attacker could potentially exploit this to conduct
cross-site scripting (XSS) attacks. (CVE-2017-7840).
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top