CVE-2018-12401

firefox: special resource URI parsing leading to denial of service

Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This could lead to denial of service (DOS) attacks. This vulnerability affects Firefox < 63.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12399

firefox: Spoofing of protocol registration notification bar

When a new protocol handler is registered, the API accepts a title argument which can be used to mislead users about which domain is registering the new protocol. This may result in the user approving a protocol handler that they otherwise would not have. This vulnerability affects Firefox < 63.

CVSS 3.0 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12398

firefox: Content Security Policy bypass through stylesheet injection in resource URIs

By using the reflected URL in some special resource URIs, such as chrome:, it is possible to inject stylesheets and bypass Content Security Policy (CSP). This vulnerability affects Firefox < 63.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12396

Mozilla: WebExtension content scripts can execute in disallowed contexts

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 8 more

CVE-2018-12395

Mozilla: WebExtension bypass of domain restrictions through header rewriting

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

CVSS 3.0 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 6 more

CVE-2018-12393

Mozilla: Integer overflow during Unicode conversion while loading JavaScript

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

CVSS 3.0 · 7.5 High EPSS 3.9% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12388

firefox: memory safety bugs showing evidence of memory corruption leading to run arbitrary code

Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63.

CVSS 3.0 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12385

Mozilla: Crash in TransportSecurityInfo due to cached data

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.

CVSS 3.0 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12383

Mozilla: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12375

Mozilla: Memory safety bugs fixed in Firefox 62

Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12374

thunderbird: Using form to exfiltrate encrypted mail part by pressing enter in form field

Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 4.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Thunderbird and 4 more

CVE-2018-12373

thunderbird: S/MIME plaintext can be leaked through HTML reply/forward

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Thunderbird and 4 more

CVE-2018-12372

thunderbird: S/MIME and PGP decryption oracles can be built with HTML emails

Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerability affects Thunderbird < 52.9.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Thunderbird and 4 more

CVE-2018-12370

Mozilla: SameSite cookie protections bypassed when exiting Reader View

In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Reader mode is active, bypassing CSRF protections. This vulnerability affects Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Canonical Mozilla

Products

Ubuntu Linux Firefox

CVE-2018-12366

Mozilla: Invalid data handling during QCMS transformations

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12365

Mozilla: Compromised IPC child process can list local filenames

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12364

Mozilla: CSRF attacks through 307 redirects and NPAPI plugins

NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12363

Mozilla: Use-after-free when appending DOM nodes

A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 3.1% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12362

Mozilla: Integer overflow in SSSE3 scaler

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 3.8% KEV · Not listed

Vendors

Canonical Debian Mozilla and 1 more

Products

Ubuntu Linux Debian Linux Firefox and 9 more

CVE-2018-12361

Mozilla: Integer overflow in SwizzleData

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed

Vendors

Canonical Debian Mozilla

Products

Ubuntu Linux Debian Linux Firefox and 2 more