VDB
CVE-2017-7843
CVE-2017-7843
PUBLISHED
CVSS 7.5 HIGH
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.
EPSS 2.95% · 86.6th percentile
Risk Scores
CVSS 3.0
7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
2.95%
86.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | firefox | *, 0 |
| Ubuntu:14.04:LTS | firefox | 28.0+build1-0ubuntu1, 28.0+build2-0ubuntu1, 28.0+build2-0ubuntu2 |
| Ubuntu:16.04:LTS | firefox | 44.0+build3-0ubuntu2, 44.0.1+build1-0ubuntu1, 45.0.1+build1-0ubuntu1 |
Timeline
- Dec 4, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 29, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 2, 2022 EPSS Score
- May 4, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Nov 9, 2022 EPSS Score
- Jan 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-7843 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-7843 third-party-advisory