CVE-2017-5386: High severity firefox vulnerability
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions. This vulnerability affects Firefox ESR < 45.7 and Firefox < 51.
Other sources
WebExtension scripts can use the data: protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions.
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5377
- CVE-2017-5378
- CVE-2017-5379
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5389
- CVE-2017-5396
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5383
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
- CVE-2017-5373
Frequently Asked Questions
What is the severity of CVE-2017-5386?
CVE-2017-5386 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-5386?
To mitigate CVE-2017-5386, upgrade to Firefox ESR version 45.7 or later, or Firefox version 51 or later.
Which versions of Firefox are affected by CVE-2017-5386?
CVE-2017-5386 affects Firefox ESR versions prior to 45.7 and Firefox versions prior to 51.
Can CVE-2017-5386 lead to privilege escalation?
Yes, CVE-2017-5386 can potentially lead to privilege escalation in affected web extensions.
Is CVE-2017-5386 connected to data disclosure?
Yes, CVE-2017-5386 can lead to data disclosure through WebExtension scripts using the data: protocol.