CVE-2018-12403: Medium severity Mozilla Firefox vulnerability
Published Oct 23, 2018
·Updated
If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users.
Affected Software
7 affected componentsFixes available
Mozilla Firefox<63.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Mozilla Firefox<63
63
debian/firefox
149.0.2-1
Event History
Oct 23, 2018
CVE Published
12:00 AM
Feb 28, 2019
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionWeakness
Jan 11, 2024
Data Sourced
via Launchpad·10:50 PM
Description
Nov 30, 2025
Data Sourced
via Ubuntu·06:17 PM
RemedyDescriptionSeverityAffected Software
Apr 8, 2026
Data Sourced
via Debian·05:02 PM
DescriptionAffected Software
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is CVE-2018-12403?
CVE-2018-12403 is a vulnerability that affects Firefox versions prior to 63.
2
How does CVE-2018-12403 affect web browsers?
CVE-2018-12403 allows web browsers to load a favicon resource over HTTP when the site is loaded over a secure HTTPS connection.
3
What is the severity of CVE-2018-12403?
CVE-2018-12403 has a severity value of 5.3, which is classified as medium.
4
How can I fix CVE-2018-12403?
To fix CVE-2018-12403, users should update their Firefox browser to version 63 or higher.
5
Where can I find more information about CVE-2018-12403?
More information about CVE-2018-12403 can be found on the Mozilla website and in the CVE database.