Security restrictions bypass in Mozilla Firefox - CVE-2017-7820

Vulnerability identifier: #VU8631

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7820

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The instanceof operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element.

Mozilla Firefox
Ubuntu

Update to version 56.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/

• Multiple vulnerabilities in Mozilla Firefox
• Ubuntu update for Firefox
• Ubuntu update for Firefox
• Ubuntu update for Firefox