CVE-2017-7840
firefox: JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in save...
CVE-2017-7840 is fixed in 4 products on 1 platform, first by firefox 57.0.1+build2-0ubuntu1, released June 11, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0112
66th percentile
JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks if users were convinced to add malicious tags to bookmarks, export them, and then open the resulting file. This vulnerability affects Firefox < 57.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 57.0.1+build2-0ubuntu1 | firefox 57.0.1+build2-0ubuntu1 | Jun 11, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 57.0.1+build2-0ubuntu1 | firefox-globalmenu 57.0.1+build2-0ubuntu1 | Jun 11, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 57.0.1+build2-0ubuntu1 | firefox-mozsymbols 57.0.1+build2-0ubuntu1 | Jun 11, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 57.0.1+build2-0ubuntu1 | firefox-testsuite 57.0.1+build2-0ubuntu1 | Jun 11, 2018 |