Log

CVE-2018-12392 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Remote
Type
+ Arbitrary code execution
Description
+ A security issue has been found in Firefox and Thunderbird versions prior to 63.0. When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12392
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/#CVE-2018-12392
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1492823
Notes
CVE-2018-12395 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Access restriction bypass
Description
+ A security issue has been found in Firefox versions prior to 63.0, where by rewriting the Host request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12395
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1467523
Notes
CVE-2018-12396 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Privilege escalation
Description
+ A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12396
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1483602
Notes
CVE-2018-12397 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Access restriction bypass
Description
+ A security issue has been found in Firefox versions prior to 63.0, where a WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12397
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1487478
Notes
CVE-2018-12398 created at 25 Sep 2019 19:31:40
Severity
+ Medium
Remote
+ Remote
Type
+ Access restriction bypass
Description
+ A security issue has been found in Firefox versions prior to 63.0, where it is possible to inject stylesheets and bypass Content Security Policy (CSP) by using the reflected URL in some special resource URIs, such as chrome:.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12398
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1460538
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1488061
Notes
CVE-2018-12399 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Content spoofing
Description
+ A security issue has been found in Firefox versions prior to 63.0, where when a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12399
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1490276
Notes
CVE-2018-12401 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Denial of service
Description
+ A security issue has been found in Firefox versions prior to 63.0, where some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12401
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1422456
Notes
CVE-2018-12402 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Information disclosure
Description
+ A security issue has been found in Firefox versions prior to 63.0, where SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page, violating cookie policy. This can result in saving the wrong version of resources based on those cookies.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12402
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1469916
Notes
CVE-2018-12403 created at 25 Sep 2019 19:31:40
Severity
+ Low
Remote
+ Remote
Type
+ Content spoofing
Description
+ A security issue has been found in Firefox versions prior to 63.0, where if a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-26/#CVE-2018-12403
+ https://bugzilla.mozilla.org/show_bug.cgi?id=1484753
Notes
CVE-2018-12405 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Remote
Type
+ Arbitrary code execution
Description
+ Several memory safety bugs have been found in Firefox < 64.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code.
References
+ https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/#CVE-2018-12405
+ https://bugzilla.mozilla.org/buglist.cgi?bug_id=1494752%2C1498765%2C1503326%2C1505181%2C1500759%2C1504365%2C1506640%2C1503082%2C1502013%2C1510471
Notes