NetSight
IP …
medium6.5

CVE-2017-5407

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user.

Impact

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 8.0
RedhatEnterprise Linux
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.4, 7.5
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0, 7.0
MozillaFirefox
before 52.0
before 45.8.0
MozillaThunderbird
before 45.8.0
before 52.0

Weakness classification

CWE-200

References