CVE-2018-5135

EUVD-2018-16921
WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox < 59.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 59.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
artful
Fixed 59.0+build5-0ubuntu0.17.10.1
released
bionic
Fixed 59.0.1+build1-0ubuntu1
released
trusty
Fixed 59.0+build5-0ubuntu0.14.04.1
released
xenial
Fixed 59.0+build5-0ubuntu0.16.04.1
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1431371
https://usn.ubuntu.com/3596-1/
https://www.mozilla.org/security/advisories/mfsa2018-06/
http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1431371
https://usn.ubuntu.com/3596-1/
https://www.mozilla.org/security/advisories/mfsa2018-06/