Linux · 
Ubuntu · Package update · May 10, 2018
Ubuntu · Package update · May 10, 2018firefox 60.0+build2-0ubuntu1: firefox 60.0+build2-0ubuntu1 for Ubuntu 18.04.6 LTS (bionic)
firefox 60.0+build2-0ubuntu1, released May 10, 2018, fixes 24 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Routine. The product is no longer supported.
RoutineUnsupported product
CVEs closed
24
None rated Critical
Exploited
0
None reported
Highest CVSS
n/a
No CVSS score published
Highest EPSS
0.2064
97th percentile
Priority of the 24 CVEs
Patch now 0
Urgent 0
High 0
Routine 24
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Routine | CVE-2018-5159 | firefox: An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow chec... | n/a | 0.2064 | None reported |
| Routine | CVE-2018-5158 | firefox: The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be in... | n/a | 0.1029 | None reported |
| Routine | CVE-2018-5177 | firefox: A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instanc... | n/a | 0.0374 | None reported |
| Routine | CVE-2018-5155 | firefox: A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths | n/a | 0.0338 | None reported |
| Routine | CVE-2018-5154 | thunderbird-mozsymbols: A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths | n/a | 0.0319 | None reported |
| Routine | CVE-2018-5150 | firefox: Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7 | n/a | 0.0309 | None reported |
| Routine | CVE-2018-5151 | firefox: Memory safety bugs were reported in Firefox 59 | n/a | 0.0275 | None reported |
| Routine | CVE-2018-5160 | firefox: WebRTC can use a "WrappedI420Buffer" pixel buffer but the owning image object can be freed while it is still in use | n/a | 0.0260 | None reported |
| Routine | CVE-2018-5181 | firefox: If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child proc... | n/a | 0.0238 | None reported |
| Routine | CVE-2018-5166 | firefox: WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redi... | n/a | 0.0235 | None reported |
| Routine | CVE-2018-5168 | firefox: Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property... | n/a | 0.0233 | None reported |
| Routine | CVE-2018-5180 | firefox: A use-after-free vulnerability can occur during WebGL operations | n/a | 0.0223 | None reported |
| Routine | CVE-2018-5163 | firefox: If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able... | n/a | 0.0205 | None reported |
| Routine | CVE-2018-5182 | firefox: If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto th... | n/a | 0.0202 | None reported |
| Routine | CVE-2018-5173 | firefox: The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file nam... | n/a | 0.0178 | None reported |
| Routine | CVE-2018-5153 | firefox: If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted | n/a | 0.0165 | None reported |
| Routine | CVE-2018-5152 | firefox: WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.c... | n/a | 0.0160 | None reported |
| Routine | CVE-2018-5172 | firefox: The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard... | n/a | 0.0159 | None reported |
| Routine | CVE-2018-5157 | firefox: Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for... | n/a | 0.0158 | None reported |
| Routine | CVE-2018-5164 | firefox: Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-m... | n/a | 0.0156 | None reported |
| Routine | CVE-2018-5175 | firefox: A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-... | n/a | 0.0143 | None reported |
| Routine | CVE-2018-5176 | firefox: The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links | n/a | 0.0142 | None reported |
| Routine | CVE-2018-5167 | firefox: The web console and JavaScript debugger do not sanitize all output that can be hyperlinked | n/a | 0.0141 | None reported |
| Routine | CVE-2018-5169 | firefox: If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the hom... | n/a | 0.0133 | None reported |
Showing 1 to 24 of 24
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.