CVE-2018-5108: Infoleak
First published: Tue Jan 23 2018(Updated: )
A Blob URL can violate origin attribute segregation, allowing it to be accessed from a private browsing tab and for data to be passed between the private browsing tab and a normal tab. This could allow for the leaking of private information specific to the private browsing context. This issue is mitigated by the requirement that the user enter the Blob URL manually in order for the access violation to occur.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <58 | 58 |
| Mozilla Firefox | <=57.0.4 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =17.10 | |
| debian/firefox | 131.0.2-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1421099
- https://www.mozilla.org/security/advisories/mfsa2018-02/
- https://usn.ubuntu.com/3544-1/
- http://www.securityfocus.com/bid/102786
- http://www.securitytracker.com/id/1040270
- https://launchpad.net/bugs/cve/CVE-2018-5108
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/#CVE-2018-5107
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/#CVE-2018-5108
- https://security-tracker.debian.org/tracker/CVE-2018-5108
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5108
- https://nvd.nist.gov/vuln/detail/CVE-2018-5108
- https://ubuntu.com/security/CVE-2018-5108
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2018-5091
- CVE-2018-5092
- CVE-2018-5093
- CVE-2018-5094
- CVE-2018-5095
- CVE-2018-5097
- CVE-2018-5098
- CVE-2018-5099
- CVE-2018-5100
- CVE-2018-5101
- CVE-2018-5102
- CVE-2018-5103
- CVE-2018-5104
- CVE-2018-5105
- CVE-2018-5106
- CVE-2018-5107
- CVE-2018-5108
- CVE-2018-5109
- CVE-2018-5110
- CVE-2018-5111
- CVE-2018-5112
- CVE-2018-5113
- CVE-2018-5114
- CVE-2018-5115
- CVE-2018-5116
- CVE-2018-5117
- CVE-2018-5118
- CVE-2018-5119
- CVE-2018-5121
- CVE-2018-5122
- CVE-2018-5090
- CVE-2018-5089
Frequently Asked Questions
What is CVE-2018-5108?
CVE-2018-5108 is a vulnerability that allows a Blob URL to violate origin attribute segregation, potentially leading to the leaking of private information from a private browsing context.
How does CVE-2018-5108 affect Mozilla Firefox?
Mozilla Firefox versions up to 58 are affected by CVE-2018-5108. Users should update to version 59.0.1 or later to fix the vulnerability.
How can I fix CVE-2018-5108 on Ubuntu?
If you are using Ubuntu, you should update your Firefox package to version 59.0.1 or later to address CVE-2018-5108.
What is the severity of CVE-2018-5108?
CVE-2018-5108 has a severity rating of medium (4) according to the Common Vulnerability Scoring System (CVSS).
Where can I find more information about CVE-2018-5108?
You can find more information about CVE-2018-5108 on the Mozilla Bugzilla and Mozilla Security Advisories websites.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/severity
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/57.0.4
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/17.10
- package-manager/debian