CVE-2018-5105
Publication date 23 January 2018
Last updated 24 July 2024
Ubuntu priority
WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file. This can result in an executable file running with local user privileges without explicit user consent. This vulnerability affects Firefox < 58.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 59.0.1+build1-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 58.0+build6-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 58.0+build6-0ubuntu0.14.04.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.8 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3544-1
- Firefox vulnerabilities
- 24 January 2018