Every CVE Search/ Get API key

CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the...

7.1 HighFix available

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.37%Down 2.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
CVE-2018-12397
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
CVE-2018-12397
Updated
2026-11-02
EUVDEUVD-2018-4371 No score

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
EUVD-2018-4371
Updated
2026-11-03
GitHub AdvisoriesGHSA-xxh5-92qj-c4gh 7.1

A WebExtension can request access to local files without the warning prompt stating that the...

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
GHSA-xxh5-92qj-c4gh
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.1

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
CVE-2018-12397
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-12397 7.1

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
DEBIAN-CVE-2018-12397
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 11 moreShow less
OSVRHSA-2018:3005 9.8

Red Hat Security Advisory: firefox security and bug fix update

Record
RHSA-2018:3005
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:3006 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2018:3006
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-12397 7.1

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

Record
UBUNTU-CVE-2018-12397
CVSS 3.0
7.1 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2018-0420 No score

Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389).

Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390).

Mozilla: Crash with nested event loops (CVE-2018-12392).

Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393).

Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395).

Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396).

Mozilla: WebExtension local file permission check bypass (CVE-2018-12397).

Record
MGASA-2018-0420
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2018:3656-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

  • Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
  • CVE-2018-12392: Crash with nested event loops.
  • CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
  • CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
  • CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
  • CVE-2018-12397: WebExtension local file access vulnerability.
  • CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
  • CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.
Record
SUSE-SU-2018:3656-1
Updated
2026-11-02
OSVSUSE-SU-2018:3749-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

  • Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
  • CVE-2018-12392: Crash with nested event loops.
  • CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
  • CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
  • CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
  • CVE-2018-12397: WebExtension local file access vulnerability.
  • CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
  • CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.
Record
SUSE-SU-2018:3749-1
Updated
2026-11-02
OSVSUSE-SU-2018:3749-2 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

  • Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
  • CVE-2018-12392: Crash with nested event loops.
  • CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
  • CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
  • CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
  • CVE-2018-12397: WebExtension local file access vulnerability.
  • CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
  • CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.
Record
SUSE-SU-2018:3749-2
Updated
2026-11-02
OSVSUSE-SU-2018:3749-3 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

  • Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
  • CVE-2018-12392: Crash with nested event loops.
  • CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
  • CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
  • CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
  • CVE-2018-12397: WebExtension local file access vulnerability.
  • CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
  • CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.
Record
SUSE-SU-2018:3749-3
Updated
2026-11-02
OSVUSN-3801-1 No score

firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass CSP restrictions, spoof the protocol registration notification bar, leak SameSite cookies, bypass mixed content warnings, or execute arbitrary code. (CVE-2018-12388, CVE-2018-12390, CVE-2018-12392, CVE-2018-12393, CVE-2018-12398, CVE-2018-12399, CVE-2018-12401, CVE-2018-12402, CVE-2018-12403)

Multiple security issues were discovered with WebExtensions in Firefox. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to bypass domain restrictions, gain additional privileges, or run content scripts in local pages without permission. (CVE-2018-12395, CVE-2018-12396, CVE-2018-12397)

Record
USN-3801-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Debian:12
 before 60.3.0esr-1
60.3.0esr-1
firefox-esr
Debian:13
 before 60.3.0esr-1
60.3.0esr-1
firefox-esr
Debian:14
 before 60.3.0esr-1
60.3.0esr-1
firefox-esr
Debian:8
From an advisory covering 8 CVEs
 before 60.3.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
60.3.0esr-1~deb8u1
firefox-esr
Debian:9
From an advisory covering 7 CVEs
 before 60.3.0esr-1~deb9u1, plus listed versions
45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1
Show 45 moreShow less
52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u152.6.0esr-1~deb9u152.6.0esr-252.6.0esr-2+alpha.152.6.0esr-2+alpha.252.7.0esr-152.7.0esr-1~deb8u152.7.0esr-1~deb9u152.7.1esr-152.7.1esr-1~deb7u152.7.1esr-1~deb8u152.7.1esr-1~deb9u152.7.2esr-152.7.2esr-1~deb7u152.7.2esr-1~deb8u152.7.2esr-1~deb9u152.7.3esr-152.7.3esr-1~deb7u152.7.3esr-1~deb8u1
60.3.0esr-1~deb9u1
firefox
Mageia:6
From an advisory covering 7 CVEs
 before 60.3.0-1.mga6
60.3.0-1.mga6
firefox-l10n
Mageia:6
From an advisory covering 7 CVEs
 before 60.3.0-1.mga6
60.3.0-1.mga6
nspr
Mageia:6
From an advisory covering 7 CVEs
 before 4.20-1.mga6
4.20-1.mga6
nss
Mageia:6
From an advisory covering 7 CVEs
 before 3.36.5-1.2.mga6
3.36.5-1.2.mga6
rootcerts
Mageia:6
From an advisory covering 7 CVEs
 before 20181001.00-1.mga6
20181001.00-1.mga6
Show 42 moreShow less
Affected packages
PackageAffectedFixed
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el7_5
0:60.3.0-1.el7_5
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 7 CVEs
 before 0:60.3.0-1.el6
0:60.3.0-1.el6
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 7 CVEs
 before 60.3.0-3.17.1
60.3.0-3.17.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Enterprise Storage 4
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 7 CVEs
 before 60.3.0-109.50.2
60.3.0-109.50.2
firefox
Ubuntu:14.04:LTS
 before 63.0+build2-0ubuntu0.14.04.2, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 45 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2
63.0+build2-0ubuntu0.14.04.2
firefox
Ubuntu:16.04:LTS
 before 63.0+build2-0ubuntu0.16.04.2, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
63.0+build2-0ubuntu0.16.04.2
firefox
Ubuntu:18.04:LTS
 before 63.0+build2-0ubuntu0.18.04.2, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 8 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.1
63.0+build2-0ubuntu0.18.04.2
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
firefox
Ubuntu:14.04:LTS
From an advisory covering 12 CVEs
 before 63.0+build2-0ubuntu0.14.04.2, plus listed versions
24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1
Show 45 moreShow less
28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.132.0+build1-0ubuntu0.14.04.132.0.3+build1-0ubuntu0.14.04.133.0+build2-0ubuntu0.14.04.134.0+build2-0ubuntu0.14.04.135.0+build3-0ubuntu0.14.04.235.0.1+build1-0ubuntu0.14.04.136.0+build2-0ubuntu0.14.04.436.0.1+build2-0ubuntu0.14.04.136.0.4+build1-0ubuntu0.14.04.137.0+build2-0ubuntu0.14.04.137.0.1+build1-0ubuntu0.14.04.137.0.2+build1-0ubuntu0.14.04.138.0+build3-0ubuntu0.14.04.139.0+build5-0ubuntu0.14.04.139.0.3+build2-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.140.0+build4-0ubuntu0.14.04.440.0.3+build1-0ubuntu0.14.04.141.0+build3-0ubuntu0.14.04.141.0.1+build2-0ubuntu0.14.04.141.0.2+build2-0ubuntu0.14.04.142.0+build2-0ubuntu0.14.04.143.0+build1-0ubuntu0.14.04.143.0.4+build3-0ubuntu0.14.04.144.0+build3-0ubuntu0.14.04.144.0.1+build2-0ubuntu0.14.04.144.0.2+build1-0ubuntu0.14.04.145.0+build2-0ubuntu0.14.04.145.0.1+build1-0ubuntu0.14.04.245.0.2+build1-0ubuntu0.14.04.146.0+build5-0ubuntu0.14.04.246.0.1+build1-0ubuntu0.14.04.347.0+build3-0ubuntu0.14.04.148.0+build2-0ubuntu0.14.04.149.0+build4-0ubuntu0.14.04.149.0.2+build2-0ubuntu0.14.04.150.0+build2-0ubuntu0.14.04.250.0.2+build1-0ubuntu0.14.04.150.1.0+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.151.0.1+build2-0ubuntu0.14.04.2
63.0+build2-0ubuntu0.14.04.2
firefox
Ubuntu:16.04:LTS
From an advisory covering 12 CVEs
 before 63.0+build2-0ubuntu0.16.04.2, plus listed versions
41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1
Show 45 moreShow less
45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.159.0.1+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.159.0.2+build1-0ubuntu0.16.04.360.0+build2-0ubuntu0.16.04.160.0.1+build2-0ubuntu0.16.04.160.0.2+build1-0ubuntu0.16.04.161.0+build3-0ubuntu0.16.04.261.0.1+build1-0ubuntu0.16.04.162.0+build2-0ubuntu0.16.04.362.0+build2-0ubuntu0.16.04.462.0+build2-0ubuntu0.16.04.5
63.0+build2-0ubuntu0.16.04.2
firefox
Ubuntu:18.04:LTS
From an advisory covering 12 CVEs
 before 63.0+build2-0ubuntu0.18.04.2, plus listed versions
56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu1
Show 8 moreShow less
60.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.362.0+build2-0ubuntu0.18.04.462.0+build2-0ubuntu0.18.04.562.0.3+build1-0ubuntu0.18.04.1
63.0+build2-0ubuntu0.18.04.2
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-12397 is a high vulnerability (CVSS 7.1) in Mozilla Firefox, published October 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in firefox-esr 60.3.0esr-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 157 versions and 1,730 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open