Vulnerability CVE-2017-7787: Information

Description

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-7787
Published: June 12, 2018
Modified: Aug. 3, 2018
Error type identifier: CWE-200

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus55.0.1-alt1125.0.3-alt1ALT-PU-2017-2060-1187059Fixed
firefoxp1055.0.1-alt1118.0.2-alt0.p10.1ALT-PU-2017-2060-1187059Fixed
firefoxp955.0.1-alt1105.0.1-alt0.c9.1ALT-PU-2017-2060-1187059Fixed
firefoxp855.0.1-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2017-2069-1187143Fixed
firefoxc10f155.0.1-alt1112.0.2-alt0.p10.1ALT-PU-2017-2060-1187059Fixed
firefoxc9f255.0.1-alt1105.0.1-alt0.c9.1ALT-PU-2017-2060-1187059Fixed
firefoxc752.5.3-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2018-1225-1200642Fixed
firefox-esrsisyphus52.3.0-alt1115.10.0-alt1ALT-PU-2017-2019-1186871Fixed
firefox-esrp1052.3.0-alt1115.10.0-alt1ALT-PU-2017-2019-1186871Fixed
firefox-esrp952.3.0-alt1102.11.0-alt0.c9.1ALT-PU-2017-2019-1186871Fixed
firefox-esrp852.3.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2017-2230-1188380Fixed
firefox-esrc10f152.3.0-alt1115.9.1-alt0.c10.1ALT-PU-2017-2019-1186871Fixed
firefox-esrc9f252.3.0-alt1102.12.0-alt0.c9.1ALT-PU-2017-2019-1186871Fixed
thunderbirdsisyphus52.3.0-alt1115.9.0-alt1ALT-PU-2017-2093-1187298Fixed
thunderbirdp1052.3.0-alt1115.9.0-alt1ALT-PU-2017-2093-1187298Fixed
thunderbirdp952.3.0-alt1102.11.0-alt0.c9.1ALT-PU-2017-2093-1187298Fixed
thunderbirdp852.3.0-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2017-2238-1188382Fixed
thunderbirdc10f152.3.0-alt1115.9.0-alt0.c10.1ALT-PU-2017-2093-1187298Fixed
thunderbirdc9f252.3.0-alt1102.11.0-alt0.c9.1ALT-PU-2017-2093-1187298Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2017-20/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-19/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-18/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1322896
  • Exploit
  • Issue Tracking
  • Vendor Advisory
DSA-3968
  • Third Party Advisory
DSA-3928
  • Third Party Advisory
GLSA-201803-14
  • Third Party Advisory
RHSA-2017:2534
  • Third Party Advisory
RHSA-2017:2456
  • Third Party Advisory
1039124
  • Third Party Advisory
  • VDB Entry
100234
  • Third Party Advisory
  • VDB Entry

    1. Configuration 1

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      52.3

      Configuration 4

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      55.0

      Configuration 5

      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      52.3
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.0
Back to top