CVE-2018-5179

EUVD-2018-16964
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 60.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
chromium-browser
bionic
Fixed 70.0.3538.67-0ubuntu0.18.04.1
released
cosmic
Fixed 70.0.3538.67-0ubuntu0.18.10.1
released
trusty
dne
xenial
Fixed 70.0.3538.67-0ubuntu0.16.04.1
released
oxide-qt
bionic
dne
cosmic
dne
trusty
dne
xenial
ignored
Common Weakness Enumeration
References
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/