Improper input validation in Mozilla Firefox
CVE-2018-5173
The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.018 (76.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Mozilla Firefox — versions unspecified
- Canonical Ubuntu_linux — versions 14.04, 16.04, 17.10
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@mozilla.org (Vendor Advisory, Permissions Required, x_refsource_CONFIRM, Issue Tracking)
Frequently asked questions
- What is CVE-2018-5173?
- CVE-2018-5173 is a medium-severity vulnerability in Mozilla Firefox, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2018-06-11.
- How severe is CVE-2018-5173?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2018-5173 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.