CVEvulnerability
CVE-2018-5163
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.1 MEDIUM — AV:N/AC:H/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-281
Description
If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process' privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60.
Affected configurations
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
• canonical ubuntu linux 18.04
• mozilla firefox (< 60.0)
Related
Weakness · CWE (1)
- CWE-281 Improper Preservation of Permissions weakness
References
- http://www.securityfocus.com/bid/104139 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040896 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1426353 Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/3645-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-11/ Vendor Advisory
- http://www.securityfocus.com/bid/104139 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1040896 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1426353 Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/3645-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-11/ Vendor Advisory