CVE-2017-7839

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 57

References

http://www.securityfocus.com/bid/101832Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039803Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1402896Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2017-24/Vendor Advisory
http://www.securityfocus.com/bid/101832Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039803Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1402896Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2017-24/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78406.1JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the res CVE-2017-78425.3If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<link>" elements instead of o CVE-2017-78437.5When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. I CVE-2017-78446.5A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determi CVE-2017-78458.8A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. Thi CVE-2017-78468.8It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website"CVE-2017-78474.3Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.CVE-2017-78485.3RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.CVE-2017-78495.5Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Ag CVE-2017-78507.8Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Age CVE-2017-78518.8D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to b CVE-2017-78528.8D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the d