Vulnerability Description
A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Aus | 7.3 |
| Redhat | Enterprise Linux Server Eus | 7.3 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Mozilla | Firefox | < 53.0 |
| Mozilla | Thunderbird | < 52.1.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/97940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038320Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1273537ExploitIssue TrackingPatch
- https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory
- http://www.securityfocus.com/bid/97940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038320Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1273537ExploitIssue TrackingPatch
- https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
FAQ
What is CVE-2017-5451?
CVE-2017-5451 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be...
How severe is CVE-2017-5451?
CVE-2017-5451 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5451?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus.