CVE-2018-5113
firefox: The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but...
CVE-2018-5113 is fixed in 4 products on 1 platform, first by firefox 59.0.1+build1-0ubuntu1, released June 11, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0201
80th percentile
The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-globalmenu 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-mozsymbols 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-testsuite 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |