# firefox 60.0+build2-0ubuntu1: firefox 60.0+build2-0ubuntu1 for Ubuntu 18.04.6 LTS (bionic)

firefox 60.0+build2-0ubuntu1, released May 10, 2018, fixes 24 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-60.0-build2-0ubuntu1
- Platform: Linux
- Released: May 10, 2018
- Priority: Routine (Closes 24 CVEs, none high severity)
- CVEs: 24, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [firefox](https://patchblox.com/security/data/product/linux/firefox.md) | Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2018-5159](https://patchblox.com/security/data/cve/CVE-2018-5159.md) | Routine | firefox: An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow chec... | n/a | 0.2064 |  |
| [CVE-2018-5158](https://patchblox.com/security/data/cve/CVE-2018-5158.md) | Routine | firefox: The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be in... | n/a | 0.1029 |  |
| [CVE-2018-5177](https://patchblox.com/security/data/cve/CVE-2018-5177.md) | Routine | firefox: A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instanc... | n/a | 0.0374 |  |
| [CVE-2018-5155](https://patchblox.com/security/data/cve/CVE-2018-5155.md) | Routine | firefox: A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths | n/a | 0.0338 |  |
| [CVE-2018-5154](https://patchblox.com/security/data/cve/CVE-2018-5154.md) | Routine | thunderbird-mozsymbols: A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths | n/a | 0.0319 |  |
| [CVE-2018-5150](https://patchblox.com/security/data/cve/CVE-2018-5150.md) | Routine | firefox: Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7 | n/a | 0.0309 |  |
| [CVE-2018-5151](https://patchblox.com/security/data/cve/CVE-2018-5151.md) | Routine | firefox: Memory safety bugs were reported in Firefox 59 | n/a | 0.0275 |  |
| [CVE-2018-5160](https://patchblox.com/security/data/cve/CVE-2018-5160.md) | Routine | firefox: WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use | n/a | 0.0260 |  |
| [CVE-2018-5181](https://patchblox.com/security/data/cve/CVE-2018-5181.md) | Routine | firefox: If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child proc... | n/a | 0.0238 |  |
| [CVE-2018-5166](https://patchblox.com/security/data/cve/CVE-2018-5166.md) | Routine | firefox: WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redi... | n/a | 0.0235 |  |
| [CVE-2018-5168](https://patchblox.com/security/data/cve/CVE-2018-5168.md) | Routine | firefox: Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property... | n/a | 0.0233 |  |
| [CVE-2018-5180](https://patchblox.com/security/data/cve/CVE-2018-5180.md) | Routine | firefox: A use-after-free vulnerability can occur during WebGL operations | n/a | 0.0223 |  |
| [CVE-2018-5163](https://patchblox.com/security/data/cve/CVE-2018-5163.md) | Routine | firefox: If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able... | n/a | 0.0205 |  |
| [CVE-2018-5182](https://patchblox.com/security/data/cve/CVE-2018-5182.md) | Routine | firefox: If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto th... | n/a | 0.0202 |  |
| [CVE-2018-5173](https://patchblox.com/security/data/cve/CVE-2018-5173.md) | Routine | firefox: The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file nam... | n/a | 0.0178 |  |
| [CVE-2018-5153](https://patchblox.com/security/data/cve/CVE-2018-5153.md) | Routine | firefox: If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted | n/a | 0.0165 |  |
| [CVE-2018-5152](https://patchblox.com/security/data/cve/CVE-2018-5152.md) | Routine | firefox: WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.c... | n/a | 0.0160 |  |
| [CVE-2018-5172](https://patchblox.com/security/data/cve/CVE-2018-5172.md) | Routine | firefox: The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard... | n/a | 0.0159 |  |
| [CVE-2018-5157](https://patchblox.com/security/data/cve/CVE-2018-5157.md) | Routine | firefox: Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for... | n/a | 0.0158 |  |
| [CVE-2018-5164](https://patchblox.com/security/data/cve/CVE-2018-5164.md) | Routine | firefox: Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-m... | n/a | 0.0156 |  |
| [CVE-2018-5175](https://patchblox.com/security/data/cve/CVE-2018-5175.md) | Routine | firefox: A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-... | n/a | 0.0143 |  |
| [CVE-2018-5176](https://patchblox.com/security/data/cve/CVE-2018-5176.md) | Routine | firefox: The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links | n/a | 0.0142 |  |
| [CVE-2018-5167](https://patchblox.com/security/data/cve/CVE-2018-5167.md) | Routine | firefox: The web console and JavaScript debugger do not sanitize all output that can be hyperlinked | n/a | 0.0141 |  |
| [CVE-2018-5169](https://patchblox.com/security/data/cve/CVE-2018-5169.md) | Routine | firefox: If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the hom... | n/a | 0.0133 |  |

---

Data as of 2026-11-11T13:47:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.