Information disclosure in Mozilla Firefox - CVE-2018-5181
Published: May 10, 2018
Vulnerability identifier: #VU12571
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5181
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper privileges or access controls. A remote attacker can drag and drop a URL using the
file: protocol onto an open tab that is running in a different child process and cause the system to display local files in tabs or the hyperlink.Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Ubuntu package)
Arch Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2018-5181
Update to version 60.0.
firefox (Ubuntu package) - addressed in versions 60.0+build2-0ubuntu0.14.04.1, 60.0+build2-0ubuntu0.16.04.1, 60.0+build2-0ubuntu0.17.10.1, 60.0+build2-0ubuntu1