NetSight
IP …
high7.8

CVE-2017-7814

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its bl…

Impact

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise be detected as suspicious. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

Affected products

VendorProductAffected versions
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Version 7.4
RedhatEnterprise Linux Server Eus
Versions 7.4, 7.5
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
MozillaFirefox
before 52.4.0
before 56.0
MozillaThunderbird
before 52.4.0
DebianDebian Linux
Versions 7.0, 8.0, 9.0

Weakness classification

CWE-20

References