Spoofing attack in Mozilla Firefox - CVE-2018-12399

Vulnerability identifier: #VU15498

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-12399

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to conduct spoofing attack on the target system.

The weakness exists due to the API accepts a title argument when a new protocol handler is registered. A remote attacker can trick the victim into visiting a specially crafted website, users about which domain is registering the new protocol to spoof protocol registration notification bar

Mozilla Firefox
Arch Linux
Ubuntu
firefox (Ubuntu package)

Update to version 63.0.

Mozilla Firefox - update to 63.0
firefox (Ubuntu package) - addressed in versions 63.0+build2-0ubuntu0.14.04.2, 63.0+build2-0ubuntu0.16.04.2, 63.0+build2-0ubuntu0.18.04.2, 63.0+build2-0ubuntu0.18.10.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/

• Multiple vulnerabilities in Mozilla Firefox
• Arch Linux update for firefox
• Ubuntu update for firefox