CVE-2018-5118 — Sensitive Information Exposure in Mozilla Firefox
Severity
5.3MEDIUMNVD
OSV9.8
EPSS
0.5%
top 33.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateMay 14
Description
The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discovered where the page could attempt to create these images through "file:" URLs from the local file system. This loading is blocked by the sandbox but could expose local data if combined with another attack that escapes sandbox protections. This vulnerability affects Firefox < 58.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4
Affected Packages4 packages
Also affects: Ubuntu Linux 14.04, 16.04, 17.10
🔴Vulnerability Details
4GHSA▶
GHSA-qwv3-5w4v-cwp9: The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites↗2022-05-14
OSV▶
CVE-2018-5118: The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites↗2018-01-23