REDHAT-BUG-1625531
First published: Wed Sep 05 2018(Updated: )
If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. External Reference: <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2018-12383">https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2018-12383</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <58 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2018-12383
- https://bugzilla.mozilla.org/show_bug.cgi?id=1475775
- https://access.redhat.com/errata/RHSA-2018:2834
- https://access.redhat.com/errata/RHSA-2018:2835
- https://access.redhat.com/errata/RHSA-2018:3403
- https://access.redhat.com/errata/RHSA-2018:3458
- https://bugzilla.redhat.com/show_bug.cgi?id=1625531
Frequently Asked Questions
What is the severity of REDHAT-BUG-1625531?
The severity of REDHAT-BUG-1625531 is classified as a moderate security issue due to the exposure of stored passwords.
How do I fix REDHAT-BUG-1625531?
To fix REDHAT-BUG-1625531, you should update to Firefox version 58 or newer and ensure all exported passwords are deleted.
What versions are affected by REDHAT-BUG-1625531?
Firefox versions prior to 58 are affected by REDHAT-BUG-1625531.
What happens if I don't address REDHAT-BUG-1625531?
If REDHAT-BUG-1625531 is not addressed, unencrypted copies of saved passwords may remain accessible.
Is my data secure if I use a master password with an affected version of Firefox?
Using a master password does not secure your older saved passwords in versions affected by REDHAT-BUG-1625531.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-12383
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/source
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- vendor/mozilla
- canonical/firefox