CVE-2017-7823: XSS
Last updated 24 July 2024
Other sources
The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
— Launchpad
The content security policy (CSP) sandbox directive did not create a unique origin for the document, causing it to behave as if the allow-same-origin keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.4 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 56 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.4 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7823?
CVE-2017-7823 is a vulnerability in Mozilla Firefox and Thunderbird that allows for Cross-Site Scripting (XSS) attacks.
How does CVE-2017-7823 affect Mozilla Firefox and Thunderbird?
CVE-2017-7823 affects Mozilla Firefox versions up to and excluding 56.0, as well as Mozilla Thunderbird versions up to and excluding 52.4.0.
What is the severity of CVE-2017-7823?
CVE-2017-7823 has a severity rating of medium, with a CVSS score of 5.4.
How can I fix CVE-2017-7823?
To fix CVE-2017-7823, update your Mozilla Firefox to version 56.0 or later, and update your Mozilla Thunderbird to version 52.4.1 or later.
Where can I find more information about CVE-2017-7823?
You can find more information about CVE-2017-7823 on the Mozilla Bugzilla website, the Mozilla security advisories page, and the SecurityFocus website.