CVE-2017-5382

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not meant to be seen by web content. This vulnerability affects Firefox < 51.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 51

References

http://www.securityfocus.com/bid/95763Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1295322Issue Tracking, Patch
https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory
http://www.securityfocus.com/bid/95763Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1295322Issue Tracking, Patch
https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-53835.3URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name CVE-2017-53845.9Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more inform CVE-2017-53857.5Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, lead CVE-2017-53867.3WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential d CVE-2017-53873.3The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a CVE-2017-53887.5A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short peri CVE-2017-53896.1WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host CVE-2017-53909.8The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers CVE-2017-53919.8Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug w CVE-2017-53929.8Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and CVE-2017-53936.1The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could CVE-2017-53948.8A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaSc