PT-2018-3591 · Mozilla+5 · Firefox+5

Tony Paloma · Published 2018-02-23 · Updated 2024-12-12 · CVE-2018-5131

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.7 Firefox versions prior to 59

Description The issue is related to the "fetch()" API, which under certain circumstances can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header, instead of downloading a copy from the network. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. The vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For Firefox ESR versions prior to 52.7, update to version 52.7 or later. For Firefox versions prior to 59, update to version 59 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-212

Related Identifiers

ALT-PU-2018-1502

ALT-PU-2018-1854

BDU:2021-00378

CESA-2018_0526

CESA-2018_0527

CVE-2018-5131

DLA-1308-1

DSA-4139-1

MGASA-2018-0202

MGASA-2018-0338

OPENSUSE-SU-2018_0681-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:0526

RHSA-2018:0527

RHSA-2018_0526

RHSA-2018_0527

SUSE-SU-2018:0850-1

SUSE-SU-2018:0907-1

USN-3596-1

USN-3596-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 1931

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-07 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-06 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4139-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4139 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5143 · Vendor Advisory
• https://mozilla.org/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://osv.dev/vulnerability/USN-3596-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0338 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00378 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0850-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5125 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0526 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5131 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5131 · Vendor Advisory