Information disclosure in Firefox ESR - CVE-2018-5131

Vulnerability identifier: #VU10970

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-5131

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the fetch() API can return transient local copies of resources that were sent with a no-store or no-cache cache header instead of downloading a copy from the network as it should. A remote attacker can share a common profile while browsing and access previously stored, locally cached data of a website.

Firefox ESR
Mozilla Firefox
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
firefox (Ubuntu package)

Update to version ESR 52.7.

firefox (Ubuntu package) - addressed in versions 59.0+build5-0ubuntu0.14.04.1, 59.0+build5-0ubuntu0.16.04.1, 59.0+build5-0ubuntu0.17.10.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-07/

• Multiple vulnerabilities in Mozilla Firefox ESR
• Multiple vulnerabilities in Mozilla Firefox
• OpenSUSE Linux update for MozillaFirefox
• Red Hat update for Mozilla Firefox
• Debian update for firefox-esr
• Gentoo update for Mozilla Firefox
• Ubuntu update for Firefox
• Red Hat update for firefox
• Red Hat update for firefox