WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/106167 | Third Party Advisory VDB Entry |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 | Issue Tracking Permissions Required Vendor Advisory |
| https://usn.ubuntu.com/3844-1/ | Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2018-29/ | Vendor Advisory |
| http://www.securityfocus.com/bid/106167 | Third Party Advisory VDB Entry |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 | Issue Tracking Permissions Required Vendor Advisory |
| https://usn.ubuntu.com/3844-1/ | Third Party Advisory |
| https://www.mozilla.org/security/advisories/mfsa2018-29/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 03:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/106167 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1427585 - Issue Tracking, Permissions Required, Vendor Advisory | |
| References | () https://usn.ubuntu.com/3844-1/ - Third Party Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2018-29/ - Vendor Advisory |
Information
Published : 2019-02-28 18:29
Updated : 2024-11-21 03:56
NVD link : CVE-2018-18495
Mitre link : CVE-2018-18495
CVE.ORG link : CVE-2018-18495
JSON object : View
Products Affected
mozilla
- firefox
canonical
- ubuntu_linux
CWE
CWE-732
Incorrect Permission Assignment for Critical Resource