PT-2017-4038 · Mozilla+2 · Firefox+2

Abdulrahman Alqabandi · Published 2017-12-08 · Updated 2024-12-12 · CVE-2018-5140

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 59

Description The issue is related to the implementation of the "moz-icon:" protocol in Mozilla Firefox, which can be accessed through script in web content even when otherwise prohibited. This could allow for information leakage of which applications are associated with specific MIME types by a malicious page. The vulnerability is associated with a lack of protection for internal data, which could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 59, update to version 59 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2018-1502

ALT-PU-2018-1854

BDU:2021-00357

CVE-2018-5140

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3596-1

USN-3596-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1898

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-06 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5143 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5140 · Security Note
• https://osv.dev/vulnerability/USN-3596-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5125 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5141 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5129 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3596-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5127 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5140 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5140 · Vendor Advisory