CVE-2018-5138: Input Validation

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1432624
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/
• http://www.securityfocus.com/bid/103386
• http://www.securitytracker.com/id/1040514
• https://www.mozilla.org/security/advisories/mfsa2018-06/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2018-06

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2018-5127
• CVE-2018-5128
• CVE-2018-5129
• CVE-2018-5130
• CVE-2018-5131
• CVE-2018-5132
• CVE-2018-5133
• CVE-2018-5134
• CVE-2018-5135
• CVE-2018-5136
• CVE-2018-5137
• CVE-2018-5138
• CVE-2018-5140
• CVE-2018-5141
• CVE-2018-5142
• CVE-2018-5143
• CVE-2018-5126
• CVE-2018-5125

Frequently Asked Questions

• What is CVE-2018-5138?

  CVE-2018-5138 is a spoofing vulnerability that can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab with Firefox for Android as the default browser.

• How does CVE-2018-5138 affect Firefox for Android?

  CVE-2018-5138 allows an attacker to spoof which page is actually loaded and in use in Firefox for Android.

• What is the severity of CVE-2018-5138?

  CVE-2018-5138 has a severity score of 5.3, which is considered medium.

• How can I fix CVE-2018-5138 in Firefox for Android?

  Update Firefox for Android to version 59 or later to fix CVE-2018-5138.

• Are all versions of Android vulnerable to CVE-2018-5138?

  No, Google Android is not vulnerable to CVE-2018-5138.