Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2017-28

Security vulnerabilities fixed in Firefox ESR 52.5.2

Announced
December 7, 2017
Impact
critical
Products
Firefox ESR
Fixed in
  • Firefox ESR 52.5.2

#CVE-2017-7845: Buffer overflow when drawing and validating elements with ANGLE library using Direct 3D 9

Reporter
Omair
Impact
critical
Description

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash.
Note: This attack only affects Windows operating systems. Other operating systems are unaffected.

References

#CVE-2017-7843: Web worker in Private Browsing mode can write IndexedDB data

Reporter
Konark
Impact
high
Description

When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely. IndexedDB should not be available in Private Browsing mode and this stored data will persist across multiple private browsing mode sessions because it is not cleared when exiting.

References