CVE-2017-7843

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox ESR	>= unspecified, < 52.5.2
Mozilla	Firefox	>= unspecified, < 57.0.1

References

http://www.securityfocus.com/bid/102039Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/102112Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039954Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3382Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1410106Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00003.htmlThird Party Advisory
https://www.debian.org/security/2017/dsa-4062Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-27/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory
http://www.securityfocus.com/bid/102039Issue Tracking, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/102112Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039954Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3382Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1410106Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/12/msg00003.htmlThird Party Advisory
https://www.debian.org/security/2017/dsa-4062Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-27/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78446.5A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determi CVE-2017-78458.8A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. Thi CVE-2017-78468.8It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website"CVE-2017-78474.3Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.CVE-2017-78485.3RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.CVE-2017-78495.5Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Ag CVE-2017-78507.8Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Age CVE-2017-78518.8D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to b CVE-2017-78528.8D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the d CVE-2017-78537.5In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function de CVE-2017-78545.5The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read CVE-2017-78556.1In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.