| Summary: | <www-client/firefox{,-bin}-{52.5.2,57.0.1}: Multiple vulnerabilities | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Kristian Fiskerstrand (RETIRED) <k_f> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | mozilla, ThyrusG |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.mozilla.org/en-US/security/advisories/mfsa2017-27/ | ||
| Whiteboard: | B4 [glsa+ cve glsa+ blocked] | ||
| Package list: |
=www-client/firefox-52.5.2
=www-client/firefox-bin-52.5.2 amd64 x86
|
Runtime testing required: | --- |
| Bug Depends on: | 645510 | ||
| Bug Blocks: | |||
ebuilds are in the tree. *** Bug 640486 has been marked as a duplicate of this bug. *** @Maintainers CVE-2017-7843 affects firefox 52 too. Please bump 52.5.2 which is fixed if we are going to keep it in tree. Thank you (In reply to Christopher Díaz Riveros from comment #3) > @Maintainers CVE-2017-7843 affects firefox 52 too. Please bump 52.5.2 which > is fixed if we are going to keep it in tree. > > Thank you ebuilds are in tree. @ Arches, please test and mark stable: =www-client/firefox-52.5.2 x86 stable amd64 stable Superseded by bug 645510. This issue was resolved and addressed in GLSA 201802-03 at https://security.gentoo.org/glsa/201802-03 by GLSA coordinator Thomas Deutschmann (whissi). |
From ${URL}: Security vulnerabilities fixed in Firefox 57.0.1 #CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data Reporter Konark Impact high Description When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. CVE-2017-7844: Visited history information leak through SVG image Reporter Daniel Jackson Impact high Description A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier releases are not affected. ## The note of not affecting earlier versions seems related to the 2nd issue only in the advisory, so we might have vulnerability in stable version as well.