Published: 11/06/2018 Updated: 03/08/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 18.04
canonical ubuntu linux 17.10
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
mozilla firefox

USN-3645-1 caused a regression in Firefox ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened This is contrary to policy and is what would happen if the string were the equivalent "file:" URL This vulnerability affects Firefox < 60 ...

Mozilla Foundation Security Advisory 2018-11 Security vulnerabilities fixed in Firefox 60 Announced May 9, 2018 Impact critical Products Firefox Fixed in Firefox 60 ...

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the address bar of Firefox before 600, the specified local file will be opened This is contrary to policy and is what would happen if the string were the equivalent file: URL ...

CWE-200 https://www.mozilla.org/security/advisories/mfsa2018-11/https://bugzilla.mozilla.org/show_bug.cgi?id=1435908 https://usn.ubuntu.com/3645-1/http://www.securitytracker.com/id/1040896 http://www.securityfocus.com/bid/104139 https://nvd.nist.gov https://usn.ubuntu.com/3645-2/

CVE-2018-5182

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect