Vulnerability CVE-2018-12396: Information

Description

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-12396
Published: Feb. 28, 2019
Modified: Oct. 3, 2019
Error type identifier: CWE-732

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus63.0.1-alt1127.0-alt1ALT-PU-2018-2645-1216395Fixed
firefoxp1063.0.1-alt1118.0.2-alt0.p10.1ALT-PU-2018-2645-1216395Fixed
firefoxp963.0.1-alt1105.0.1-alt0.c9.1ALT-PU-2018-2645-1216395Fixed
firefoxp863.0.3-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2018-2742-1216526Fixed
firefoxc10f163.0.1-alt1112.0.2-alt0.p10.1ALT-PU-2018-2645-1216395Fixed
firefoxc9f263.0.1-alt1105.0.1-alt0.c9.1ALT-PU-2018-2645-1216395Fixed
firefoxc760.6.1-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-1726-1218597Fixed
firefoxp1163.0.1-alt1126.0.1-alt1ALT-PU-2018-2645-1216395Fixed
firefox-esrsisyphus60.3.0-alt1115.11.0-alt1ALT-PU-2018-2550-1215469Fixed
firefox-esrp1060.3.0-alt1115.11.0-alt1ALT-PU-2018-2550-1215469Fixed
firefox-esrp968.0.2-alt1102.11.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp860.3.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-2565-1215471Fixed
firefox-esrc10f160.3.0-alt1115.9.1-alt0.c10.1ALT-PU-2018-2550-1215469Fixed
firefox-esrc9f268.0.2-alt1102.12.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp1160.3.0-alt1115.11.0-alt1ALT-PU-2018-2550-1215469Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-27/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1483602
  • Broken Link
  • Issue Tracking
  • Vendor Advisory
DSA-4324
  • Third Party Advisory
USN-3801-1
  • Third Party Advisory
GLSA-201811-04
  • Third Party Advisory
[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update
  • Third Party Advisory
RHSA-2018:3006
  • Third Party Advisory
RHSA-2018:3005
  • Third Party Advisory
1041944
  • Third Party Advisory
  • VDB Entry
105718
  • Third Party Advisory
  • VDB Entry

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      63.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      60.3

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top