CVE-2018-5131
firefox: Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "n...
CVE-2018-5131 is fixed in 4 products on 1 platform, first by firefox 59.0.1+build1-0ubuntu1, released June 11, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0225
82nd percentile
Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-globalmenu 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-mozsymbols 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-testsuite 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |