VDB
CVE-2017-7821
CVE-2017-7821
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.
EPSS 1.95% · 79.5th percentile
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
1.95%
79.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | firefox | 0, 42.0+build2-0ubuntu1, 44.0.1+build1-0ubuntu1 |
| Ubuntu:18.04:LTS | firefox | 0 |
| Ubuntu:14.04:LTS | firefox | 44.0.2+build1-0ubuntu0.14.04.1, 45.0+build2-0ubuntu0.14.04.1, 45.0.1+build1-0ubuntu0.14.04.2 |
Timeline
- Sep 29, 2017 CVE Published
- Sep 29, 2017 PoC Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Mar 2, 2022 EPSS Score
- May 4, 2022 EPSS Score
- Jul 6, 2022 EPSS Score
- Sep 8, 2022 EPSS Score
- Jan 12, 2023 EPSS Score
- Mar 16, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-7821 third-party-advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/ third-party-advisory
- https://ubuntu.com/security/notices/USN-3435-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-7821 third-party-advisory