CVE-2018-5142: Medium severity Mozilla Firefox vulnerability
If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission. This vulnerability affects Firefox < 59.
Other sources
If Media Capture and Streams API permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for this permission.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5142?
CVE-2018-5142 is a vulnerability in Mozilla Firefox and Ubuntu Linux that allows requests for Media Capture and Streams API permission from documents with 'data:' or 'blob:' URLs to display the wrong originating domain.
Which software products are affected by CVE-2018-5142?
Mozilla Firefox versions up to exclusive 59.0 and Ubuntu Linux versions 14.04, 16.04, and 17.10 are affected by CVE-2018-5142.
What is the severity of CVE-2018-5142?
The severity of CVE-2018-5142 is medium, with a CVSS score of 5.3.
How can I fix CVE-2018-5142 in Mozilla Firefox?
To fix CVE-2018-5142 in Mozilla Firefox, update to version 59.0 or higher.
How can I fix CVE-2018-5142 in Ubuntu Linux?
To fix CVE-2018-5142 in Ubuntu Linux, apply the applicable security patch or update the Firefox package to version 59.0 or higher.