PT-2018-8425 · Mozilla+1 · Firefox For Android+1

Takeshi Terada · Published 2017-07-15 · Updated 2018-08-07 · CVE-2017-7759

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 54

Description A security issue exists where Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs. This allows for the reading of local data through a violation of same-origin policy. The issue only affects Firefox for Android and does not impact other operating systems.

Recommendations For versions prior to 54, update to version 54 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1886

ALT-PU-2018-1854

CVE-2017-7759

Affected Products

Alt Linux

Firefox For Android

References · 6

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1356893 · Exploit
• https://osv.dev/vulnerability/CVE-2017-7759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7759 · Security Note
• https://mozilla.org/security/advisories/mfsa2017-15 · Vendor Advisory
• http://securitytracker.com/id/1038689 · Note
• http://securityfocus.com/bid/99052 · Note