# firefox 57.0.1+build2-0ubuntu1: firefox 57.0.1+build2-0ubuntu1 for Ubuntu 18.04.6 LTS (bionic)

firefox 57.0.1+build2-0ubuntu1, released June 11, 2018, fixes 16 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-57.0.1-build2-0ubuntu1
- Platform: Linux
- Released: Jun 11, 2018
- Priority: Routine (Closes 16 CVEs, none high severity)
- CVEs: 16, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | Ubuntu 18.04.6 LTS (bionic) | 57.0.1+build2-0ubuntu1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2017-7828](https://patchblox.com/security/data/cve/CVE-2017-7828.md) | Routine | xul-ext-calendar-timezones: A use-after-free vulnerability can occur when flushing and resizing layout because the "PressShell" object has been f... | n/a | 0.0720 |  |
| [CVE-2017-7826](https://patchblox.com/security/data/cve/CVE-2017-7826.md) | Routine | firefox: Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4 | n/a | 0.0334 |  |
| [CVE-2017-7843](https://patchblox.com/security/data/cve/CVE-2017-7843.md) | Routine | firefox: When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerp... | n/a | 0.0289 |  |
| [CVE-2017-7827](https://patchblox.com/security/data/cve/CVE-2017-7827.md) | Routine | firefox: Memory safety bugs were reported in Firefox 56 | n/a | 0.0273 |  |
| [CVE-2017-7830](https://patchblox.com/security/data/cve/CVE-2017-7830.md) | Routine | firefox: The Resource Timing API incorrectly revealed navigations in cross-origin iframes | n/a | 0.0240 |  |
| [CVE-2017-7844](https://patchblox.com/security/data/cve/CVE-2017-7844.md) | Routine | firefox: A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image... | n/a | 0.0172 |  |
| [CVE-2017-7831](https://patchblox.com/security/data/cve/CVE-2017-7831.md) | Routine | firefox: A vulnerability where the security wrapper does not deny access to someexposed properties using the deprecated "_expo... | n/a | 0.0156 |  |
| [CVE-2017-7842](https://patchblox.com/security/data/cve/CVE-2017-7842.md) | Routine | firefox: If a document's Referrer Policy attribute is set to "no-referrer" sometimes two network requests are made for "<li... | n/a | 0.0151 |  |
| [CVE-2017-7834](https://patchblox.com/security/data/cve/CVE-2017-7834.md) | Routine | firefox: A "data:" URL loaded in a new tab did not inherit the Content Security Policy (CSP) of the original page, allowing fo... | n/a | 0.0151 |  |
| [CVE-2017-7835](https://patchblox.com/security/data/cve/CVE-2017-7835.md) | Routine | firefox: Mixed content blocking of insecure (HTTP) sub-resources in a secure (HTTPS) document was not correctly applied for re... | n/a | 0.0149 |  |
| [CVE-2017-7832](https://patchblox.com/security/data/cve/CVE-2017-7832.md) | Routine | firefox: The combined, single character, version of the letter 'i' with any of the potential accents in unicode, such as acute... | n/a | 0.0148 |  |
| [CVE-2017-7833](https://patchblox.com/security/data/cve/CVE-2017-7833.md) | Routine | firefox: Some Arabic and Indic vowel marker characters can be combined with Latin characters in a domain name to eclipse the n... | n/a | 0.0144 |  |
| [CVE-2017-7837](https://patchblox.com/security/data/cve/CVE-2017-7837.md) | Routine | firefox: SVG loaded through "<img>" tags can use "<meta>" tags within the SVG data to set cookies for that page | n/a | 0.0144 |  |
| [CVE-2017-7838](https://patchblox.com/security/data/cve/CVE-2017-7838.md) | Routine | firefox: Punycode format text will be displayed for entire qualified international domain names in some instances when a sub-d... | n/a | 0.0144 |  |
| [CVE-2017-7839](https://patchblox.com/security/data/cve/CVE-2017-7839.md) | Routine | firefox: Control characters prepended before "javascript:" URLs pasted in the addressbar can cause the leading characters to b... | n/a | 0.0112 |  |
| [CVE-2017-7840](https://patchblox.com/security/data/cve/CVE-2017-7840.md) | Routine | firefox: JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in save... | n/a | 0.0112 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.