Information disclosure in Mozilla Firefox - CVE-2018-5167
Published: May 10, 2018
Vulnerability identifier: #VU12550
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5167
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper linkification of chrome: and javascript: content in web console and JavaScript debugger. A remote attacker can supply specially crafted output
and cause JavaScript debugger to display some content as clickable links.
The weakness exists due to improper linkification of chrome: and javascript: content in web console and JavaScript debugger. A remote attacker can supply specially crafted output
and cause JavaScript debugger to display some content as clickable links.
Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Ubuntu package)
Arch Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2018-5167
Update to version 60.0.
firefox (Ubuntu package) - addressed in versions 60.0+build2-0ubuntu0.14.04.1, 60.0+build2-0ubuntu0.16.04.1, 60.0+build2-0ubuntu0.17.10.1, 60.0+build2-0ubuntu1