CVE-2018-5118
Publication date 23 January 2018
Last updated 25 August 2025
Ubuntu priority
Description
The screenshot images displayed in the Activity Stream page displayed when a new tab is opened is created from the meta tags of websites. An issue was discovered where the page could attempt to create these images through "file:" URLs from the local file system. This loading is blocked by the sandbox but could expose local data if combined with another attack that escapes sandbox protections. This vulnerability affects Firefox < 58.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 59.0.1+build1-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 58.0+build6-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 58.0+build6-0ubuntu0.14.04.1
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
5.3 · Medium
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-3544-1
- Firefox vulnerabilities
- 24 January 2018