PT-2017-4044 · Mozilla+2 · Firefox+2

Masato Kinugawa · Published 2017-12-03 · Updated 2024-12-12 · CVE-2018-5143

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 59

Description The issue is related to the implementation of the JavaScript programming language in the Mozilla Firefox browser, specifically with the protection measures for the web page structure. It allows an attacker to conduct cross-site scripting (XSS) attacks. If a tab character is embedded in a "javascript:" URL, the protocol is not removed when pasted into the address bar, and the script will execute, potentially allowing users to be socially engineered into running an XSS attack against themselves.

Recommendations For versions prior to 59, update to version 59 or later to resolve the issue. As a temporary workaround, consider avoiding the use of "javascript:" URLs with embedded tab characters in the address bar until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2018-1502

ALT-PU-2018-1854

BDU:2021-00426

CVE-2018-5143

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3596-1

USN-3596-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1898

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-06 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5143 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3596-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5143 · Security Note
• https://ubuntu.com/security/CVE-2018-5125 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-5143 · Security Note
• https://ubuntu.com/security/CVE-2018-5141 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5129 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-5143 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3596-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5127 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5131 · Vendor Advisory
• https://usn.ubuntu.com/3596-1 · Vendor Advisory