CVE-2018-5134

published 2018-03-14

CVE-2018-5134: CVE-2018-5125 firefox vulnerabilities firefox vulnerabilities Multiple security issues were discovered in Firefox. If a user were tricked in to opening a…

Priority P3 37 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

CVE-2018-5125 firefox vulnerabilities
firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash or opening new tabs, escape the sandbox, bypass same-origin
restrictions, obtain sensitive information, confuse the user with
misleading permission requests, or execute arbitrary code. (CVE-2018-5125,
CVE-2018-5126, CVE-2018-5127, CVE-2018-5128, CVE-2018-5129, CVE-2018-5130,
CVE-2018-5136, CVE-2018-5137, CVE-2018-5140, CVE-2018-5141, CVE-2018-5142)

It was discovered that the fetch() API could incorrectly return cached
copies of no-store/no-cache resources in some circumstances. A local
attacker could potentially exploit this to obtain sensitive informati

Affected

4 ranges

Vendor	Product	Version range	Fixed in
mozilla	firefox	>= 0 < 59.0+build5-0ubuntu0.14.04.1	59.0+build5-0ubuntu0.14.04.1
mozilla	firefox	>= 0 < 59.0.2+build1-0ubuntu0.14.04.4	59.0.2+build1-0ubuntu0.14.04.4
mozilla	firefox	>= 0 < 59.0+build5-0ubuntu0.16.04.1	59.0+build5-0ubuntu0.16.04.1
mozilla	firefox	>= 0 < 59.0.2+build1-0ubuntu0.16.04.3	59.0.2+build1-0ubuntu0.16.04.3

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

osv 8.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.