CVE-2018-5113: High severity Mozilla Firefox vulnerability
Last updated 24 July 2024
Other sources
The "browser.identity.launchWebAuthFlow" function of WebExtensions is only allowed to load content over "https:" but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension. This vulnerability affects Firefox < 58.
— Launchpad
The browser.identity.launchWebAuthFlow function of WebExtensions is only allowed to load content over https: but this requirement was not properly enforced. This can potentially allow privileged pages to be loaded by the extension.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 131.0.2-2 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 58
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2018-5091
- CVE-2018-5092
- CVE-2018-5093
- CVE-2018-5094
- CVE-2018-5095
- CVE-2018-5097
- CVE-2018-5098
- CVE-2018-5099
- CVE-2018-5100
- CVE-2018-5101
- CVE-2018-5102
- CVE-2018-5103
- CVE-2018-5104
- CVE-2018-5105
- CVE-2018-5106
- CVE-2018-5107
- CVE-2018-5108
- CVE-2018-5109
- CVE-2018-5110
- CVE-2018-5111
- CVE-2018-5112
- CVE-2018-5113
- CVE-2018-5114
- CVE-2018-5115
- CVE-2018-5116
- CVE-2018-5117
- CVE-2018-5118
- CVE-2018-5119
- CVE-2018-5121
- CVE-2018-5122
- CVE-2018-5090
- CVE-2018-5089
Frequently Asked Questions
What is CVE-2018-5113?
CVE-2018-5113 is a vulnerability in the "browser.identity.launchWebAuthFlow" function of WebExtensions in Firefox < 58 that allows privileged pages to be loaded by the extension when content is loaded over HTTP.
What software is affected by CVE-2018-5113?
Firefox versions before 58 are affected by CVE-2018-5113.
How severe is CVE-2018-5113?
CVE-2018-5113 has a severity rating of 7.5 (High).
How can I fix CVE-2018-5113?
To fix CVE-2018-5113, update your Firefox browser to version 58 or higher.
Where can I get more information about CVE-2018-5113?
You can find more information about CVE-2018-5113 on the Mozilla Bugzilla page and the Mozilla Security Advisories page.