CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...

Design/Logic Flaw

A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

UBUNTU-CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...

CVE-2017-7757

A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...

CVE-2017-7757

A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2...

CVE-2017-7843

Summary (CVE-2017-7843) : In Firefox, Private Browsing mode could be exploited by a web worker to persist data in IndexedDB, enabling cross-session fingerprinting. Affected are Firefox ESR versions older than 52.5.2 and Firefox versions older than 57.0.1. The root cause is that IndexedDB remains ...

CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...

CVE-2017-7843

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not...

CVE-2017-7757

CVE-2017-7757 is a use-after-free vulnerability in IndexedDB that can occur when an IndexedDB object is destroyed while a method on it is executing, potentially causing a crash. Affected products include Firefox versions before 54, Firefox ESR before 52.2, and Thunderbird before 52.2. The issue a...

chromium-browser: Use after free in indexedDB

Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page...

Google Chrome indexedDB memory misreference vulnerability (CNVD-2018-11496)

Google Chrome is a web browser developed by Google, Inc. and IndexedDB is one of the built-in databases. A memory misreference vulnerability exists in indexedDB in versions of Google Chrome prior to 67.0.3396.62. A remote attacker could exploit this vulnerability by tricking a user into visiting ...

Security update for chromium (important)

This update for chromium to version 66.0.3359.181 fixes the following issues: The following security issues were fixed boo1095163: CVE-2018-6123: Use after free in Blink. CVE-2018-6124: Type confusion in Blink. CVE-2018-6125: Overly permissive policy in WebUSB. CVE-2018-6126: Heap buffer overflow...

Third party CSS is not safe

A few days ago there was a lot of chatter about a 'keylogger' built in CSS. Some folks called for browsers to 'fix' it. Some folks dug a bit deeper and saw that it only affected sites built in React-like frameworks, and pointed the finger at React. But the real problem is thinking that third part...

The vulnerability of Google Chrome’s IndexedDB implementation lies in its reliance on memory after it is released. This allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability in the Google Chrome browser’s IndexedDB implementation relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of data through a specially crafted HTML page...

EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1326)

According to the version of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A privacy flaw was discovered in Firefox. In Private Browsing mode, a web worker could write persistent data to IndexedDB, which was not cleared wh...

EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1327)

According to the version of the firefox package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A privacy flaw was discovered in Firefox. In Private Browsing mode, a web worker could write persistent data to IndexedDB, which was not cleared wh...

openSUSE Security Update : MozillaFirefox (openSUSE-2017-1366)

This update for MozillaFirefox to 52.5.2esr fixes the following issue : - CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data boo1072034, bmo1410106, MFSA 2017-28 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin we...

Debian DSA-4062-1 : firefox-esr - security update

It was discovered that the Private Browsing mode in the Mozilla Firefox web browser allowed to fingerprint a user across multiple sessions via IndexedDB. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security...

[SECURITY] [DSA 4062-1] firefox-esr security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4062-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2017 https://www.debian.org/security/faq -...