CVE-2017-7843 Information disclosure in Firefox

Q: Is CVE-2017-7843 being exploited?

There is no known exploitation of CVE-2017-7843 in the wild and no public exploit code.

High 7.5 Published 11 Jun 2018 Updated 5 Aug 2024

Attackers can uniquely fingerprint users by persisting IndexedDB data across Private Browsing sessions in Firefox.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-7843?

CVE-2017-7843 is a high-severity vulnerability in Debian Debian Linux, published on 11 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting. This vulnerability affects Firefox ESR < 52.5.2 and Firefox < 57.0.1.

Weakness: CWE-200

Which versions are affected by CVE-2017-7843?

It affects 7 products.

Linux distribution packages (14)

`firefox` Red Hat:enterprise_linux:6::client	All versions	`0:52.5.1-1.el6_9`
`firefox-debuginfo` Red Hat:enterprise_linux:6::client	All versions	`0:52.5.1-1.el6_9`
`firefox` Red Hat:enterprise_linux:6::computenode	All versions	`0:52.5.1-1.el6_9`
`firefox-debuginfo` Red Hat:enterprise_linux:6::computenode	All versions	`0:52.5.1-1.el6_9`
`firefox` Red Hat:enterprise_linux:6::server	All versions	`0:52.5.1-1.el6_9`
`firefox-debuginfo` Red Hat:enterprise_linux:6::server	All versions	`0:52.5.1-1.el6_9`
`firefox` Red Hat:enterprise_linux:6::workstation	All versions	`0:52.5.1-1.el6_9`
`firefox-debuginfo` Red Hat:enterprise_linux:6::workstation	All versions	`0:52.5.1-1.el6_9`
`firefox` Red Hat:enterprise_linux:7::client	All versions	`0:52.5.1-1.el7_4`
`firefox-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:52.5.1-1.el7_4`
`firefox` Red Hat:enterprise_linux:7::server	All versions	`0:52.5.1-1.el7_4`
`firefox-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:52.5.1-1.el7_4`
`firefox` Red Hat:enterprise_linux:7::workstation	All versions	`0:52.5.1-1.el7_4`
`firefox-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:52.5.1-1.el7_4`

Products include Debian Debian Linux, Mozilla Firefox, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus and 1 more.

How do I fix CVE-2017-7843?

Upgrade to a fixed version.

Is CVE-2017-7843 being exploited?

There is no known exploitation of CVE-2017-7843 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-7843, DLA-1202-1, DSA-4062-1, GHSA-rpf5-xpfp-546f, MGASA-2017-0448, RHSA-2017:3382 and 1 more.