{
  "fix": "firefox 60.0\u002Bbuild2-0ubuntu1",
  "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-60.0-build2-0ubuntu1",
  "summary": "firefox 60.0\u002Bbuild2-0ubuntu1, released May 10, 2018, fixes 24 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.",
  "platform": "linux",
  "type": "package",
  "title": "firefox 60.0\u002Bbuild2-0ubuntu1 for Ubuntu 18.04.6 LTS (bionic)",
  "released": "2018-05-10T17:00:00Z",
  "priority": "Routine",
  "priorityTier": 4,
  "priorityReason": "Closes 24 CVEs, none high severity",
  "supported": false,
  "cveCount": 24,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.20641,
  "appliesTo": [
    {
      "product": "firefox",
      "productUrl": "https://patchblox.com/security/product/linux/firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "60.0\u002Bbuild2-0ubuntu1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2018-5159",
      "url": "https://patchblox.com/security/cve/CVE-2018-5159",
      "title": "firefox: An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow chec...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.20641,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5158",
      "url": "https://patchblox.com/security/cve/CVE-2018-5158",
      "title": "firefox: The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be in...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.10285,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5177",
      "url": "https://patchblox.com/security/cve/CVE-2018-5177",
      "title": "firefox: A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instanc...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03738,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5155",
      "url": "https://patchblox.com/security/cve/CVE-2018-5155",
      "title": "firefox: A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03379,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5154",
      "url": "https://patchblox.com/security/cve/CVE-2018-5154",
      "title": "thunderbird-mozsymbols: A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03194,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5150",
      "url": "https://patchblox.com/security/cve/CVE-2018-5150",
      "title": "firefox: Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.03086,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5151",
      "url": "https://patchblox.com/security/cve/CVE-2018-5151",
      "title": "firefox: Memory safety bugs were reported in Firefox 59",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02749,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5160",
      "url": "https://patchblox.com/security/cve/CVE-2018-5160",
      "title": "firefox: WebRTC can use a \u0022WrappedI420Buffer\u0022 pixel buffer but the owning image object can be freed while it is still in use",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02601,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5181",
      "url": "https://patchblox.com/security/cve/CVE-2018-5181",
      "title": "firefox: If a URL using the \u0022file:\u0022 protocol is dragged and dropped onto an open tab that is running in a different child proc...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02384,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5166",
      "url": "https://patchblox.com/security/cve/CVE-2018-5166",
      "title": "firefox: WebExtensions can use request redirection and a \u0022filterReponseData\u0022 filter to bypass host permission settings to redi...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02354,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5168",
      "url": "https://patchblox.com/security/cve/CVE-2018-5168",
      "title": "firefox: Sites can bypass security checks on permissions to install lightweight themes by manipulating the \u0022baseURI\u0022 property...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02332,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5180",
      "url": "https://patchblox.com/security/cve/CVE-2018-5180",
      "title": "firefox: A use-after-free vulnerability can occur during WebGL operations",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02232,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5163",
      "url": "https://patchblox.com/security/cve/CVE-2018-5163",
      "title": "firefox: If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02045,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5182",
      "url": "https://patchblox.com/security/cve/CVE-2018-5182",
      "title": "firefox: If a text string that happens to be a filename in the operating system\u0027s native format is dragged and dropped onto th...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.02016,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5173",
      "url": "https://patchblox.com/security/cve/CVE-2018-5173",
      "title": "firefox: The filename appearing in the \u0022Downloads\u0022 panel improperly renders some Unicode characters, allowing for the file nam...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01784,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5153",
      "url": "https://patchblox.com/security/cve/CVE-2018-5153",
      "title": "firefox: If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01646,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5152",
      "url": "https://patchblox.com/security/cve/CVE-2018-5152",
      "title": "firefox: WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.c...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01597,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5172",
      "url": "https://patchblox.com/security/cve/CVE-2018-5172",
      "title": "firefox: The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.0159,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5157",
      "url": "https://patchblox.com/security/cve/CVE-2018-5157",
      "title": "firefox: Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01583,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5164",
      "url": "https://patchblox.com/security/cve/CVE-2018-5164",
      "title": "firefox: Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the \u0022multipart/x-m...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01564,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5175",
      "url": "https://patchblox.com/security/cve/CVE-2018-5175",
      "title": "firefox: A mechanism to bypass Content Security Policy (CSP) protections on sites that have a \u0022script-src\u0022 policy of \u0022\u0027strict-...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01425,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5176",
      "url": "https://patchblox.com/security/cve/CVE-2018-5176",
      "title": "firefox: The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including \u0022javascript:\u0022 links",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01416,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5167",
      "url": "https://patchblox.com/security/cve/CVE-2018-5167",
      "title": "firefox: The web console and JavaScript debugger do not sanitize all output that can be hyperlinked",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01414,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2018-5169",
      "url": "https://patchblox.com/security/cve/CVE-2018-5169",
      "title": "firefox: If manipulated hyperlinked text with \u0022chrome:\u0022 URL contained in it is dragged and dropped on the \u0022home\u0022 icon, the hom...",
      "priority": "Routine",
      "severity": "Medium",
      "epss": 0.01325,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T13:47:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}