CVE-2018-5179: High severity firefox vulnerability
A lack of limits on update() flaw was found in the ServiceWorker component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=805496
External References:
https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
Other sources
A service worker can send the "activate" event on itself periodically which allows it to run perpetually. This would allow any malicious activity, such as logging an IP address by the service worker, to occur in the background.
A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by users. Affects all versions prior to Firefox 60.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2018-5154
- CVE-2018-5155
- CVE-2018-5157
- CVE-2018-5158
- CVE-2018-5159
- CVE-2018-5160
- CVE-2018-5152
- CVE-2018-5153
- CVE-2018-5163
- CVE-2018-5164
- CVE-2018-5166
- CVE-2018-5167
- CVE-2018-5168
- CVE-2018-5169
- CVE-2018-5172
- CVE-2018-5173
- CVE-2018-5174
- CVE-2018-5175
- CVE-2018-5176
- CVE-2018-5177
- CVE-2018-5165
- CVE-2018-5180
- CVE-2018-5181
- CVE-2018-5182
- CVE-2018-5179
- CVE-2018-5151
- CVE-2018-5150
Frequently Asked Questions
What is CVE-2018-5179?
CVE-2018-5179 is a vulnerability that allows a service worker to send the "activate" event on itself periodically, allowing it to run perpetually and potentially perform malicious activity in the background.
Which software is affected by CVE-2018-5179?
The affected software includes Mozilla Firefox version up to exclusive 60, and Chromium Browser version up to exclusive 70.0.3538.67.
What is the severity of CVE-2018-5179?
CVE-2018-5179 has a severity rating of high (7.5).
How can I fix CVE-2018-5179 in Mozilla Firefox?
To fix CVE-2018-5179 in Mozilla Firefox, update to a version higher than 60.0.
How can I fix CVE-2018-5179 in Chromium Browser?
To fix CVE-2018-5179 in Chromium Browser, update to a version higher than 70.0.3538.67.