#VU12536 Memory leak in Mozilla Firefox - CVE-2018-5152

Vulnerability identifier: #VU12536

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2018-5152

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Mozilla Firefox

Software vendor:
Mozilla

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to network traffic to the site through the webRequest API. A remote attacker can intercept username and an encrypted password during login to Firefox Accounts.

Update to version 60.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/