{
  "fix": "firefox 59.0.1\u002Bbuild1-0ubuntu1",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-59.0.1-build1-0ubuntu1",
  "summary": "firefox 59.0.1\u002Bbuild1-0ubuntu1, released June 11, 2018, fixes 52 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "firefox 59.0.1\u002Bbuild1-0ubuntu1 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2018-06-11T14:29:00Z",
  "priority": "Urgent",
  "priorityTier": 2,
  "priorityReason": "Closes CVE-2017-5754, rated Critical",
  "supported": false,
  "cveCount": 52,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.93838,
  "appliesTo": [
    {
      "product": "firefox",
      "productUrl": "https://patchblox.com/security/product/linux/firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "59.0.1\u002Bbuild1-0ubuntu1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2017-5754",
      "url": "https://patchblox.com/security/cve/CVE-2017-5754",
      "title": "firefox: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized di...",
      "priority": "Urgent",
      "severity": "Critical",
      "epss": 0.67407,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2017-5753",
      "url": "https://patchblox.com/security/cve/CVE-2017-5753",
      "title": "firefox: Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure...",
      "priority": "High",
      "severity": "High",
      "epss": 0.93838,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2017-5715",
      "url": "https://patchblox.com/security/cve/CVE-2017-5715",
      "title": "amd64-microcode: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized di...",
      "priority": "High",
      "severity": "High",
      "epss": 0.73249,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5124",
      "url": "https://patchblox.com/security/cve/CVE-2018-5124",
      "title": "firefox: Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox...",
      "priority": "High",
      "severity": "High",
      "epss": 0.01013,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5093",
      "url": "https://patchblox.com/security/cve/CVE-2018-5093",
      "title": "firefox: A heap buffer overflow vulnerability may occur in WebAssembly duringMemory/Table resizing, resulting in a potentially...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.19412,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5094",
      "url": "https://patchblox.com/security/cve/CVE-2018-5094",
      "title": "firefox: A heap buffer overflow vulnerability may occur in WebAssembly when\u0022shrinkElements\u0022 is called followed by garbage coll...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.14961,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5127",
      "url": "https://patchblox.com/security/cve/CVE-2018-5127",
      "title": "firefox: A buffer overflow can occur when manipulating the SVG \u0022animatedPathSegList\u0022 through script",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.07832,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5097",
      "url": "https://patchblox.com/security/cve/CVE-2018-5097",
      "title": "firefox: A use-after-free vulnerability can occur during XSL transformations when the source document for the transformation i...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.07028,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5104",
      "url": "https://patchblox.com/security/cve/CVE-2018-5104",
      "title": "firefox: A use-after-free vulnerability can occur during font face manipulation when a font face is freed while still in use,...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.07028,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5102",
      "url": "https://patchblox.com/security/cve/CVE-2018-5102",
      "title": "firefox: A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a pot...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.06926,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5100",
      "url": "https://patchblox.com/security/cve/CVE-2018-5100",
      "title": "firefox: A use-after-free vulnerability can occur when arguments passed to the \u0022IsPotentiallyScrollable\u0022 function are freed wh...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.05268,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5095",
      "url": "https://patchblox.com/security/cve/CVE-2018-5095",
      "title": "firefox: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with a...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.04127,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5089",
      "url": "https://patchblox.com/security/cve/CVE-2018-5089",
      "title": "firefox: Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03335,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5091",
      "url": "https://patchblox.com/security/cve/CVE-2018-5091",
      "title": "firefox: A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03283,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5129",
      "url": "https://patchblox.com/security/cve/CVE-2018-5129",
      "title": "firefox: A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03037,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5098",
      "url": "https://patchblox.com/security/cve/CVE-2018-5098",
      "title": "firefox: A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script co...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0301,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5099",
      "url": "https://patchblox.com/security/cve/CVE-2018-5099",
      "title": "firefox: A use-after-free vulnerability can occur when the widget listener is holding strong references to browser objects tha...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02966,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5103",
      "url": "https://patchblox.com/security/cve/CVE-2018-5103",
      "title": "firefox: A use-after-free vulnerability can occur during mouse event handling due to issues with multiprocess support",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02966,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5122",
      "url": "https://patchblox.com/security/cve/CVE-2018-5122",
      "title": "firefox: A potential integer overflow in the \u0022DoCrypt\u0022 function of WebCrypto was identified",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.02769,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5125",
      "url": "https://patchblox.com/security/cve/CVE-2018-5125",
      "title": "firefox: Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02478,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5115",
      "url": "https://patchblox.com/security/cve/CVE-2018-5115",
      "title": "firefox: If an HTTP authentication prompt is triggered by a background network request from a page or extension, it is display...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02434,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5147",
      "url": "https://patchblox.com/security/cve/CVE-2018-5147",
      "title": "firefox: The libtremor library has the same flaw as CVE-2018-5146",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0239,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5117",
      "url": "https://patchblox.com/security/cve/CVE-2018-5117",
      "title": "firefox: If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02338,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5130",
      "url": "https://patchblox.com/security/cve/CVE-2018-5130",
      "title": "firefox: When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially e...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02315,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5090",
      "url": "https://patchblox.com/security/cve/CVE-2018-5090",
      "title": "firefox: Memory safety bugs were reported in Firefox 57",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02269,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5131",
      "url": "https://patchblox.com/security/cve/CVE-2018-5131",
      "title": "firefox: Under certain circumstances the \u0022fetch()\u0022 API can return transient local copies of resources that were sent with a \u0022n...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.02247,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5113",
      "url": "https://patchblox.com/security/cve/CVE-2018-5113",
      "title": "firefox: The \u0022browser.identity.launchWebAuthFlow\u0022 function of WebExtensions is only allowed to load content over \u0022https:\u0022 but...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02006,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5112",
      "url": "https://patchblox.com/security/cve/CVE-2018-5112",
      "title": "firefox: Development Tools panels of an extension are required to load URLs for the panels as relative URLs from the extension...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01947,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5092",
      "url": "https://patchblox.com/security/cve/CVE-2018-5092",
      "title": "firefox: A use-after-free vulnerability can occur when the thread for a Web Worker is freed from memory prematurely instead of...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5128",
      "url": "https://patchblox.com/security/cve/CVE-2018-5128",
      "title": "firefox: A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor opera...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0178,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5126",
      "url": "https://patchblox.com/security/cve/CVE-2018-5126",
      "title": "firefox: Memory safety bugs were reported in Firefox 58",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01768,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5101",
      "url": "https://patchblox.com/security/cve/CVE-2018-5101",
      "title": "firefox: A use-after-free vulnerability can occur when manipulating floating \u0022first-letter\u0022 style elements, resulting in a pot...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0176,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5107",
      "url": "https://patchblox.com/security/cve/CVE-2018-5107",
      "title": "firefox: The printing process can bypass local access protections to read files available through symlinks, bypassing local fi...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01734,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5134",
      "url": "https://patchblox.com/security/cve/CVE-2018-5134",
      "title": "firefox: WebExtensions may use \u0022view-source:\u0022 URLs to view local \u0022file:\u0022 URL content, as well as content stored in \u0022about:cach...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01624,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5137",
      "url": "https://patchblox.com/security/cve/CVE-2018-5137",
      "title": "firefox: A legacy extension\u0027s non-contentaccessible, defined resources can be loaded by an arbitrary web page through script",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01624,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5136",
      "url": "https://patchblox.com/security/cve/CVE-2018-5136",
      "title": "firefox: A shared worker created from a \u0022data:\u0022 URL in one tab can be shared by another tab with a different origin, bypassing...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0159,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5141",
      "url": "https://patchblox.com/security/cve/CVE-2018-5141",
      "title": "firefox: A vulnerability in the notifications Push API where notifications can be sent through service workers by web content...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.01553,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5111",
      "url": "https://patchblox.com/security/cve/CVE-2018-5111",
      "title": "firefox-mozsymbols: When the text of a specially formatted URL is dragged to the addressbar from page content, the displayed URL can be s...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01548,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5114",
      "url": "https://patchblox.com/security/cve/CVE-2018-5114",
      "title": "firefox: If an existing cookie is changed to be \u0022HttpOnly\u0022 while a document is open, the original value remains accessible thr...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5118",
      "url": "https://patchblox.com/security/cve/CVE-2018-5118",
      "title": "firefox: The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the me...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5119",
      "url": "https://patchblox.com/security/cve/CVE-2018-5119",
      "title": "firefox-globalmenu: The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin c...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.01526,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5135",
      "url": "https://patchblox.com/security/cve/CVE-2018-5135",
      "title": "firefox: WebExtensions can bypass normal restrictions in some circumstances and use \u0022browser.tabs.executeScript\u0022 to inject scr...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01497,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5133",
      "url": "https://patchblox.com/security/cve/CVE-2018-5133",
      "title": "firefox: If the \u0022app.support.baseURL\u0022 preference is changed by a malicious local program to contain HTML and script content, t...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0149,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5132",
      "url": "https://patchblox.com/security/cve/CVE-2018-5132",
      "title": "firefox: The Find API for WebExtensions can search some privileged pages, such as \u0022about:debugging\u0022, if these pages are open i...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0144,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5140",
      "url": "https://patchblox.com/security/cve/CVE-2018-5140",
      "title": "firefox: Image for moz-icons can be accessed through the \u0022moz-icon:\u0022 protocol through script in web content even when otherwis...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.01273,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5106",
      "url": "https://patchblox.com/security/cve/CVE-2018-5106",
      "title": "firefox: Style editor traffic in the Developer Tools can be routed through a service worker hosted on a third party website if...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01246,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5142",
      "url": "https://patchblox.com/security/cve/CVE-2018-5142",
      "title": "firefox: If Media Capture and Streams API permission is requested from documents with \u0022data:\u0022 or \u0022blob:\u0022 URLs, the permission...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.01188,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5116",
      "url": "https://patchblox.com/security/cve/CVE-2018-5116",
      "title": "firefox: WebExtensions with the \u0022ActiveTab\u0022 permission are able to access frames hosted within the active tab even if the fram...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01144,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5108",
      "url": "https://patchblox.com/security/cve/CVE-2018-5108",
      "title": "firefox: A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for d...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01128,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5143",
      "url": "https://patchblox.com/security/cve/CVE-2018-5143",
      "title": "firefox: URLs using \u0022javascript:\u0022 have the protocol removed when pasted into the addressbar to protect users from cross-site s...",
      "priority": "Routine",
      "severity": "Low",
      "epss": 0.00919,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5109",
      "url": "https://patchblox.com/security/cve/CVE-2018-5109",
      "title": "firefox: An audio capture session can started under an incorrect origin from the site making the capture request",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00604,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5105",
      "url": "https://patchblox.com/security/cve/CVE-2018-5105",
      "title": "firefox: WebExtensions can bypass user prompts to first save and then open an arbitrarily downloaded file",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.00415,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-12T01:51:14Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}