CVE-2017-7823

Description

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified. This could allow a Cross-Site Scripting (XSS) attack to be launched from unsafe content. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

How to fix CVE-2017-7823

To remediate CVE-2017-7823, upgrade the affected package to a fixed version below.

• —upgrade to 52.4.0esr-2 or later
• —upgrade to 1:52.4.0-1 or later

Is CVE-2017-7823 being exploited?

Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 52.4.0esr-2
• from 0, < 1:52.4.0-1

CVSS scores

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-7823