CVE-2017-7843: Infoleak
When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 57.0.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.5.2 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 52.5.2-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7843?
CVE-2017-7843 is a vulnerability that allows a web worker to write persistent data to IndexedDB in Private Browsing mode, potentially fingerprinting a user uniquely.
Which software is affected by CVE-2017-7843?
Mozilla Firefox versions up to 57.0.1, Mozilla Firefox ESR versions up to 52.5.2, and Debian versions including 118.0.2-1 and certain packages of Firefox-esr are affected by CVE-2017-7843.
What is the severity level of CVE-2017-7843?
CVE-2017-7843 has a severity level of high with a severity value of 7.
How can I fix CVE-2017-7843?
To fix CVE-2017-7843, update Mozilla Firefox to version 57.0.1 or later, Mozilla Firefox ESR to version 52.5.2 or later, or update the affected Debian packages to their respective patched versions.
Where can I find more information about CVE-2017-7843?
You can find more information about CVE-2017-7843 on the following references: [1] [2] [3].