Vulnerability CVE-2018-5135: Information

Description

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox < 59.

Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-5135
Published: June 12, 2018
Modified: Oct. 3, 2019
Error type identifier: CWE-862

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus59.0.2-alt1127.0-alt1ALT-PU-2018-1502-1203049Fixed
firefoxp1059.0.2-alt1118.0.2-alt0.p10.1ALT-PU-2018-1502-1203049Fixed
firefoxp959.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2018-1502-1203049Fixed
firefoxp859.0.2-alt1.M80P.168.0.1-alt0.M80P.1ALT-PU-2018-1553-1203220Fixed
firefoxc10f159.0.2-alt1112.0.2-alt0.p10.1ALT-PU-2018-1502-1203049Fixed
firefoxc9f259.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2018-1502-1203049Fixed
firefoxc760.6.1-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-1726-1218597Fixed
firefoxp1159.0.2-alt1126.0.1-alt1ALT-PU-2018-1502-1203049Fixed
firefox-esrsisyphus60.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed
firefox-esrp1060.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed
firefox-esrp960.0.1-alt1102.11.0-alt0.c9.1ALT-PU-2018-1854-1207816Fixed
firefox-esrp860.1.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-1966-1207865Fixed
firefox-esrc10f160.0.1-alt1115.9.1-alt0.c10.1ALT-PU-2018-1854-1207816Fixed
firefox-esrc9f260.0.1-alt1102.12.0-alt0.c9.1ALT-PU-2018-1854-1207816Fixed
firefox-esrp1160.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-06/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1431371
  • Permissions Required
USN-3596-1
  • Third Party Advisory
1040514
  • Third Party Advisory
  • VDB Entry
103386
  • Third Party Advisory
  • VDB Entry

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      59.0
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top