Skip to content
OpenAdvisories
Unscored CVE-2017-7834 EUVD-2017-16809GHSA-5q3m-44wf-w4hc

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the poli…

Published Jun 11, 2018 · Updated Aug 5, 2024 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Package: firefox Category: Browsers Ecosystem: Ubuntu

Description

A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing for bypasses of the policy including the execution of JavaScript. In prior versions when "data:" documents also inherited the context of the original page this would allow for potential cross-site scripting (XSS) attacks. This vulnerability affects Firefox < 57.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 57 57

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS firefox 57.0.1+build2-0ubuntu1 —
Ubuntu 16.04 LTS firefox 57.0+build4-0ubuntu0.16.04.5 USN-3477-1
Ubuntu 14.04 LTS firefox 57.0+build4-0ubuntu0.14.04.4 USN-3477-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 92.0-1.2 openSUSE-SU-2024:10600-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 3

References