CVE-2017-7821
Publication date 2 October 2017
Last updated 25 August 2025
Ubuntu priority
Description
A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 56.0+build6-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 56.0+build6-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 56.0+build6-0ubuntu0.14.04.1
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3435-1
- Firefox vulnerabilities
- 2 October 2017