Security restrictions bypass in Mozilla Firefox - CVE-2018-18495

Vulnerability identifier: #VU16490

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-18495

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to WebExtension content scripts can be loaded into about: pages in some circumstances. A remote attacker can use a specially crafted extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions.

Mozilla Firefox
Arch Linux

Update to version 64.0.

Mozilla Firefox - update to 64.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/

• Multiple vulnerabilities in Mozilla Firefox
• Arch Linux update for firefox