Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2017-27

Security vulnerabilities fixed in Firefox 57.0.1

Announced
November 29, 2017
Impact
critical
Products
Firefox
Fixed in
  • Firefox 57.0.1

#CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

Reporter
Konark
Impact
high
Description

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting.

References

#CVE-2017-7844: Visited history information leak through SVG image

Reporter
Daniel Jackson
Impact
high
Description

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history.
Note: This issue only affects Firefox 57. Earlier releases are not affected.

References