CVE-2018-5133: Infoleak
If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This stored preference is also executed whenever an EME video player plugin displays a CDM-disabled message as a notification message. This vulnerability affects Firefox < 59.
Other sources
If the app.support.baseURL preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads chrome://browser/content/preferences/in-content/preferences.xul directly in a tab and executes a search. This stored preference is also executed whenever an EME video player plugin displays a CDM-disabled message as a notification message.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2018-5133.
What is the severity of CVE-2018-5133?
The severity of CVE-2018-5133 is medium with a score of 6.5.
What is the affected software for CVE-2018-5133?
The affected software for CVE-2018-5133 includes Mozilla Firefox versions up to 59.0, Canonical Ubuntu Linux 14.04, 16.04, and 17.10.
How can I fix CVE-2018-5133?
To fix CVE-2018-5133, update Mozilla Firefox to version 59.0 or higher or follow the recommended updates for Canonical Ubuntu Linux.
Where can I find more information about CVE-2018-5133?
For more information about CVE-2018-5133, you can refer to the following references: [Mozilla Bugzilla: 1430511](https://bugzilla.mozilla.org/show_bug.cgi?id=1430511), [Mozilla Bugzilla: 1430974](https://bugzilla.mozilla.org/show_bug.cgi?id=1430974), [Mozilla Security Advisory: mfsa2018-06](https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/).