PT-2018-3168 · Mozilla+5 · Firefox+5

Rob Wu · Published 2018-10-23 · Updated 2024-12-12 · CVE-2018-12396

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60.3 Firefox versions prior to 63

Description The issue allows a WebExtension to run content scripts in disallowed contexts following navigation or other events, potentially leading to privilege escalation on sites where content scripts should not be run. This could enable a remote attacker to elevate their privileges.

Recommendations For Firefox ESR versions prior to 60.3, update to version 60.3 or later. For Firefox versions prior to 63, update to version 63 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2018-2550

ALT-PU-2018-2645

ALT-PU-2019-2324

ALT-PU-2019-2486

BDU:2019-04299

CESA-2018_3005

CESA-2018_3006

CVE-2018-12396

DLA-1571-1

DSA-4324-1

MGASA-2018-0420

OPENSUSE-SU-2018_3435-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:3005

RHSA-2018:3006

RHSA-2018_3005

RHSA-2018_3006

SUSE-SU-2018:3656-1

SUSE-SU-2018:3749-1

SUSE-SU-2018:3749-2

SUSE-SU-2018:3749-3

USN-3801-1

USN-3801-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 1921

• https://ubuntu.com/security/CVE-2018-12392 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-26 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12390 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3749-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12396 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1483602 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://mozilla.org/en-US/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12397 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-26 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12396 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-12396 · Security Note
• https://ubuntu.com/security/CVE-2018-12399 · Vendor Advisory