ISOMAN

CVE

CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Severity
HIGH
CVSS
7.1
Published
Modified
NVD detailAll CVEs

Linked Releases

DistributionReleaseStatusEvidence
Ubuntu18.04.6 amd64 desktopunknownsource
Ubuntu18.04.6 amd64 live-serverunknownsource
Ubuntu16.04.7 amd64 desktopunknownsource
Ubuntu16.04.6 i386 desktopunknownsource
Ubuntu16.04.7 amd64 serverunknownsource
Ubuntu16.04.6 i386 serverunknownsource
Ubuntu14.04.6 amd64 desktopunknownsource
Ubuntu14.04.6 i386 desktopunknownsource
Ubuntu14.04.6 amd64 serverunknownsource
Ubuntu14.04.6 i386 serverunknownsource

References

  1. http://www.securityfocus.com/bid/105718
  2. http://www.securitytracker.com/id/1041944
  3. https://access.redhat.com/errata/RHSA-2018:3005
  4. https://access.redhat.com/errata/RHSA-2018:3006
  5. https://bugzilla.mozilla.org/show_bug.cgi?id=1487478
  6. https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html
  7. https://security.gentoo.org/glsa/201811-04
  8. https://usn.ubuntu.com/3801-1/
  9. https://www.debian.org/security/2018/dsa-4324
  10. https://www.mozilla.org/security/advisories/mfsa2018-26/
  11. https://www.mozilla.org/security/advisories/mfsa2018-27/
  12. http://www.securityfocus.com/bid/105718
  13. http://www.securitytracker.com/id/1041944
  14. https://access.redhat.com/errata/RHSA-2018:3005
  15. https://access.redhat.com/errata/RHSA-2018:3006
  16. https://bugzilla.mozilla.org/show_bug.cgi?id=1487478
  17. https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html
  18. https://security.gentoo.org/glsa/201811-04
  19. https://usn.ubuntu.com/3801-1/
  20. https://www.debian.org/security/2018/dsa-4324