CVE-2018-5141

A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user interaction. This could be used to open new tabs in a denial of service (DOS) attack or to display unwanted content from arbitrary URLs to users. This vulnerability affects Firefox < 59.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.2 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
mozillaCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
VendorProductVersion
mozillafirefox
𝑥
< 59.0
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
17.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
bionic
Fixed 59.0.1+build1-0ubuntu1
released
artful
Fixed 59.0+build5-0ubuntu0.17.10.1
released
xenial
Fixed 59.0+build5-0ubuntu0.16.04.1
released
trusty
Fixed 59.0+build5-0ubuntu0.14.04.1
released
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1429093
https://usn.ubuntu.com/3596-1/
https://www.mozilla.org/security/advisories/mfsa2018-06/
http://www.securityfocus.com/bid/103386
http://www.securitytracker.com/id/1040514
https://bugzilla.mozilla.org/show_bug.cgi?id=1429093
https://usn.ubuntu.com/3596-1/
https://www.mozilla.org/security/advisories/mfsa2018-06/