Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2017-5407: Debian and Red Hat Linux can leak webpage data
CVE-2017-5407 · published 8 years ago
Summary
Older releases of Debian Linux and Red Hat Enterprise Linux contain a component that can be tricked by a malicious web page to read hidden screen information from other sites. This could allow an attacker to discover a user’s browsing history or read text from other pages. Update the operating system to the latest version or apply the security patches supplied by the distribution to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
8.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
7.3 7.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
7.3 7.4 7.5 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
5.0 6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* |
| mozilla | firefox |
< 52.0 < 45.8.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | thunderbird |
< 45.8.0 < 52.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history informat...
Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.
References
- http://rhn.redhat.com/errata/RHSA-2017-0459.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0461.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0498.html Third Party Advisory
- http://www.securityfocus.com/bid/96693 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037966 Third Party Advisory VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1336622 Exploit Issue Tracking Vendor Advisory
- https://security.gentoo.org/glsa/201705-06 Third Party Advisory
- https://security.gentoo.org/glsa/201705-07 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3805 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3832 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-05/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-06/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-07/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-09/ Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-200Information Exposure
Timeline
Published11 Jun 2018
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-5407 · NVD
Track software like this
Free during beta