Memory leak in Mozilla Firefox - CVE-2018-5152

Vulnerability identifier: #VU12536

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-5152

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the webRequest API. A remote attacker can intercept username and an encrypted password during login to Firefox Accounts.

Mozilla Firefox
Arch Linux

Update to version 60.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/

• Multiple vulnerabilities in Mozilla Firefox
• Arch Linux update for firefox