CVE-2018-5176: Input Validation

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1442840
• https://www.mozilla.org/security/advisories/mfsa2018-11/
• https://usn.ubuntu.com/3645-1/
• http://www.securityfocus.com/bid/104139
• http://www.securitytracker.com/id/1040896
• https://launchpad.net/bugs/cve/CVE-2018-5176
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5172
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5176
• https://security-tracker.debian.org/tracker/CVE-2018-5176
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5176
• https://nvd.nist.gov/vuln/detail/CVE-2018-5176
• https://ubuntu.com/security/CVE-2018-5176

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2018-11

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2018-5154
• CVE-2018-5155
• CVE-2018-5157
• CVE-2018-5158
• CVE-2018-5159
• CVE-2018-5160
• CVE-2018-5152
• CVE-2018-5153
• CVE-2018-5163
• CVE-2018-5164
• CVE-2018-5166
• CVE-2018-5167
• CVE-2018-5168
• CVE-2018-5169
• CVE-2018-5172
• CVE-2018-5173
• CVE-2018-5174
• CVE-2018-5175
• CVE-2018-5176
• CVE-2018-5177
• CVE-2018-5165
• CVE-2018-5180
• CVE-2018-5181
• CVE-2018-5182
• CVE-2018-5179
• CVE-2018-5151
• CVE-2018-5150

Frequently Asked Questions

• What is CVE-2018-5176?

  CVE-2018-5176 is a vulnerability in the JSON Viewer of Mozilla Firefox that allows for the execution of malicious JavaScript code through clickable hyperlinks.

• How does CVE-2018-5176 work?

  CVE-2018-5176 works by displaying clickable hyperlinks for URLs in a JSON file, including 'javascript:' links, which can trick users into executing malicious code.

• Which software is affected by CVE-2018-5176?

  Mozilla Firefox versions up to and exclusive of 60.0, as well as Ubuntu with Firefox versions up to and exclusive of 60.0, are affected by CVE-2018-5176.

• What is the severity of CVE-2018-5176?

  CVE-2018-5176 has a severity value of 6.1, indicating a medium severity level.

• How can I fix CVE-2018-5176?

  To fix CVE-2018-5176, update your Mozilla Firefox or Ubuntu with Firefox to a version higher than 60.0.