CVE-2017-5415
Medium · 5.3CVSS
5.3
EPSS
12.3%
Published
Jun 11, 2018
CISA due date
—
The record
An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:5 | iceape | 0 | 2.49.1-3.mga5 |
| Mageia:6 | iceape | 0 | 2.49.1-3.mga6 |
| Ubuntu:14.04:LTS | firefox | 0 | 52.0+build2-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | firefox | 0 | 52.0+build2-0ubuntu0.16.04.1 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 92.0-1.2 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2017-7826 Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Also affects iceape
- CVE-2017-7805 During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. Also affects iceape
- CVE-2017-7810 Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Also affects iceape
- CVE-2017-7793 A use-after-free vulnerability can occur in the Fetch API when the worker or the… Also affects iceape
- CVE-2017-7753 An out-of-bounds read occurs when applying style rules to pseudo-elements, such as… Also affects iceape
- CVE-2017-5465 An out-of-bounds read while processing SVG content in "ConvolvePixel". Also affects iceape
- CVE-2017-5470 Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Also affects iceape
- CVE-2017-5447 An out-of-bounds read during the processing of glyph widths during text layout. Also affects iceape