CVE-2017-7814
Publication date 2 October 2017
Last updated 24 July 2024
Ubuntu priority
File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 56.0+build6-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 56.0+build6-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 56.0+build6-0ubuntu0.14.04.1
|
|
| thunderbird | 18.04 LTS bionic |
Fixed 1:52.4.0+build1-0ubuntu2
|
| 16.04 LTS xenial |
Fixed 1:52.4.0+build1-0ubuntu0.16.04.2
|
|
| 14.04 LTS trusty |
Fixed 1:52.4.0+build1-0ubuntu0.14.04.2
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3436-1
- Thunderbird vulnerabilities
- 11 October 2017
- USN-3435-1
- Firefox vulnerabilities
- 2 October 2017