CVE-2017-7787

EUVD-2017-16762
Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
8.0
debiandebian_linux
9.0
redhatenterprise_linux
5.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux_desktop
5.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
5.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_workstation
5.0
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
mozillathunderbird
𝑥
< 52.3
mozillafirefox
𝑥
< 55.0
mozillafirefox_esr
𝑥
< 52.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
artful
Fixed 55.0.2+build1-0ubuntu4
released
bionic
Fixed 55.0.2+build1-0ubuntu4
released
cosmic
Fixed 55.0.2+build1-0ubuntu4
released
disco
Fixed 55.0.2+build1-0ubuntu4
released
trusty
Fixed 55.0.1+build2-0ubuntu0.14.04.2
released
xenial
Fixed 55.0.1+build2-0ubuntu0.16.04.2
released
zesty
Fixed 55.0.1+build2-0ubuntu0.17.04.2
released
mozjs38
artful
ignored
bionic
not-affected
cosmic
dne
disco
dne
trusty
dne
xenial
dne
zesty
ignored
thunderbird
artful
Fixed 1:52.4.0+build1-0ubuntu2
released
bionic
Fixed 1:52.4.0+build1-0ubuntu2
released
cosmic
Fixed 1:52.4.0+build1-0ubuntu2
released
disco
Fixed 1:52.4.0+build1-0ubuntu2
released
trusty
Fixed 1:52.3.0+build1-0ubuntu0.14.04.1
released
xenial
Fixed 1:52.3.0+build1-0ubuntu0.16.04.1
released
zesty
Fixed 1:52.3.0+build1-0ubuntu0.17.04.1
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/100234
http://www.securitytracker.com/id/1039124
https://access.redhat.com/errata/RHSA-2017:2456
https://access.redhat.com/errata/RHSA-2017:2534
https://bugzilla.mozilla.org/show_bug.cgi?id=1322896
https://security.gentoo.org/glsa/201803-14
https://www.debian.org/security/2017/dsa-3928
https://www.debian.org/security/2017/dsa-3968
https://www.mozilla.org/security/advisories/mfsa2017-18/
https://www.mozilla.org/security/advisories/mfsa2017-19/
https://www.mozilla.org/security/advisories/mfsa2017-20/
http://www.securityfocus.com/bid/100234
http://www.securitytracker.com/id/1039124
https://access.redhat.com/errata/RHSA-2017:2456
https://access.redhat.com/errata/RHSA-2017:2534
https://bugzilla.mozilla.org/show_bug.cgi?id=1322896
https://security.gentoo.org/glsa/201803-14
https://www.debian.org/security/2017/dsa-3928
https://www.debian.org/security/2017/dsa-3968
https://www.mozilla.org/security/advisories/mfsa2017-18/
https://www.mozilla.org/security/advisories/mfsa2017-19/
https://www.mozilla.org/security/advisories/mfsa2017-20/