Information disclosure in Mozilla Firefox - CVE-2017-7762

Vulnerability identifier: #VU7103

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7762

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The weakness exists due to Reader Mode did not strip the username and password section of URLs displayed in the addressbar when entering directly. A remote attacker can perform domain spoofing attacks and read arbitrary files.

Successful exploitation of the vulnerability results in information disclosure.

Mozilla Firefox
Arch Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Ubuntu

Update to version 54.0.

Mozilla Firefox - update to 54.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/

• Arch Linux update for firefox
• Ubuntu update for Firefox
• Red Hat update for Mozilla Firefox
• Red Hat update for Mozilla Firefox
• Multiple vulnerabilities in Mozilla Firefox