CVE-2017-5386: High severity Mozilla Firefox vulnerability
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.
Other sources
WebExtension scripts can use the data: protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 51 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.7.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5377
- CVE-2017-5378
- CVE-2017-5379
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5389
- CVE-2017-5396
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5383
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
- CVE-2017-5373
Frequently Asked Questions
What is the severity of CVE-2017-5386?
CVE-2017-5386 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-5386?
To mitigate CVE-2017-5386, upgrade to Firefox ESR version 45.7 or later, or Firefox version 51 or later.
Which versions of Firefox are affected by CVE-2017-5386?
CVE-2017-5386 affects Firefox ESR versions prior to 45.7 and Firefox versions prior to 51.
Can CVE-2017-5386 lead to privilege escalation?
Yes, CVE-2017-5386 can potentially lead to privilege escalation in affected web extensions.
Is CVE-2017-5386 connected to data disclosure?
Yes, CVE-2017-5386 can lead to data disclosure through WebExtension scripts using the data: protocol.