{"id":"CVE-2018-18499","aliases":["DEBIAN-CVE-2018-18499","DLA-1571-1","DLA-1575-1","DSA-4287-1","DSA-4327-1","EUVD-2018-10224","GHSA-h7hh-7f6j-x9mh","RHSA-2018:2692","RHSA-2018:2693","RHSA-2018:3403","RHSA-2018:3458","UBUNTU-CVE-2018-18499"],"status":"published","title":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta...","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01093,"percentile":0.6568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-346"],"published":"2018-09-07T00:00:00Z","modified":"2026-10-23T18:03:02Z","fixes":[{"ecosystem":"Debian:12","package":"firefox-esr","fixed_in":["60.2.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firefox-esr","fixed_in":["60.2.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"firefox-esr","fixed_in":["60.2.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:60.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:60.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:60.2.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","fixed_in":["1:60.2.1+build1-0ubuntu0.14.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"firefox","fixed_in":["62.0+build2-0ubuntu0.16.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","fixed_in":["1:60.2.1+build1-0ubuntu0.16.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:60.2.1+build1-0ubuntu0.18.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.0esr-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.3.0esr-1~deb8u1"}]}],"versions":["45.0.1esr-1","45.0.2esr-1","45.0esr-1","45.0esr-2","45.1.0esr-1","45.1.1esr-1","45.2.0esr-1","45.2.0esr-1~deb7u1","45.2.0esr-1~deb8u1","45.3.0esr-1","45.3.0esr-1~deb7u1","45.3.0esr-1~deb8u1","45.3.0esr-2","45.4.0esr-1","45.4.0esr-1~deb7u1","45.4.0esr-1~deb7u2","45.4.0esr-1~deb8u1","45.4.0esr-1~deb8u2","45.4.0esr-2","45.5.0esr-1","45.5.0esr-1~deb8u1","45.5.1esr-1","45.5.1esr-1~deb7u1","45.5.1esr-1~deb8u1","45.6.0esr-1","45.6.0esr-1~deb7u1","45.6.0esr-1~deb8u1","45.7.0esr-1","45.7.0esr-1~deb7u1","45.7.0esr-1~deb8u1","45.7.0esr-2","45.7.0esr-3","45.7.0esr-4","45.8.0esr-1","45.8.0esr-1~deb7u1","45.8.0esr-1~deb8u1","45.9.0esr-1","45.9.0esr-1~deb7u1","45.9.0esr-1~deb8u1","52.0.1esr-1","52.0.2esr-1","52.0esr-1","52.1.0esr-1","52.2.0esr-1","52.2.0esr-1~deb7u1","52.2.0esr-1~deb8u1","52.2.0esr-1~deb9u1","52.2.0esr-2","52.3.0esr-1","52.3.0esr-1~deb7u1","52.3.0esr-1~deb8u1","52.3.0esr-1~deb8u2","52.3.0esr-1~deb9u1","52.3.0esr-2","52.4.0esr-1~deb8u1","52.4.0esr-1~deb9u1","52.4.0esr-2","52.4.0esr-2~deb7u1","52.5.0esr-1","52.5.0esr-1~deb7u1","52.5.0esr-1~deb8u1","52.5.0esr-1~deb9u1","52.5.2esr-1","52.5.2esr-1~deb7u1","52.5.2esr-1~deb8u1","52.5.2esr-1~deb9u1","52.5.3esr-1","52.6.0esr-1","52.6.0esr-1~deb7u1","52.6.0esr-1~deb8u1","52.6.0esr-1~deb9u1","52.6.0esr-2","52.6.0esr-2+alpha.1","52.6.0esr-2+alpha.2","52.7.0esr-1","52.7.0esr-1~deb8u1","52.7.0esr-1~deb9u1","52.7.1esr-1","52.7.1esr-1~deb7u1","52.7.1esr-1~deb8u1","52.7.1esr-1~deb9u1","52.7.2esr-1","52.7.2esr-1~deb7u1","52.7.2esr-1~deb8u1","52.7.2esr-1~deb9u1","52.7.3esr-1","52.7.3esr-1~deb7u1","52.7.3esr-1~deb8u1","52.7.3esr-1~deb9u1","52.8.0esr-1","52.8.0esr-1~deb7u1","52.8.0esr-1~deb8u1","52.8.0esr-1~deb9u1","52.8.1esr-1","52.8.1esr-1~deb8u1","52.8.1esr-1~deb9u1","52.8.1esr-2","52.9.0esr-1","52.9.0esr-1~deb8u1","52.9.0esr-1~deb9u1","60.0.1esr-1","60.0.1esr-2","60.0.2esr-1","60.0esr-1","60.1.0esr-1","60.1.0esr-2","60.1.0esr-3","60.2.0esr-1","60.2.0esr-1~deb9u1","60.2.0esr-1~deb9u2","60.2.1esr-1","60.2.1esr-1~deb9u1","60.2.2esr-1","60.2.2esr-1~deb9u1"],"bundled":8},{"source":"osv","ecosystem":"Debian:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.3.0-1~deb8u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1","1:60.2.1-2~deb9u1"],"bundled":17},{"source":"osv","ecosystem":"Debian:9","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"60.2.0esr-1~deb9u2"}]}],"versions":["45.9.0esr-1","52.0.1esr-1","52.0.2esr-1","52.0esr-1","52.1.0esr-1","52.2.0esr-1","52.2.0esr-1~deb7u1","52.2.0esr-1~deb8u1","52.2.0esr-1~deb9u1","52.2.0esr-2","52.3.0esr-1","52.3.0esr-1~deb7u1","52.3.0esr-1~deb8u1","52.3.0esr-1~deb8u2","52.3.0esr-1~deb9u1","52.3.0esr-2","52.4.0esr-1~deb8u1","52.4.0esr-1~deb9u1","52.4.0esr-2","52.4.0esr-2~deb7u1","52.5.0esr-1","52.5.0esr-1~deb7u1","52.5.0esr-1~deb8u1","52.5.0esr-1~deb9u1","52.5.2esr-1","52.5.2esr-1~deb7u1","52.5.2esr-1~deb8u1","52.5.2esr-1~deb9u1","52.5.3esr-1","52.6.0esr-1","52.6.0esr-1~deb7u1","52.6.0esr-1~deb8u1","52.6.0esr-1~deb9u1","52.6.0esr-2","52.6.0esr-2+alpha.1","52.6.0esr-2+alpha.2","52.7.0esr-1","52.7.0esr-1~deb8u1","52.7.0esr-1~deb9u1","52.7.1esr-1","52.7.1esr-1~deb7u1","52.7.1esr-1~deb8u1","52.7.1esr-1~deb9u1","52.7.2esr-1","52.7.2esr-1~deb7u1","52.7.2esr-1~deb8u1","52.7.2esr-1~deb9u1","52.7.3esr-1","52.7.3esr-1~deb7u1","52.7.3esr-1~deb8u1","52.7.3esr-1~deb9u1","52.8.0esr-1","52.8.0esr-1~deb7u1","52.8.0esr-1~deb8u1","52.8.0esr-1~deb9u1","52.8.1esr-1","52.8.1esr-1~deb8u1","52.8.1esr-1~deb9u1","52.8.1esr-2","52.9.0esr-1","52.9.0esr-1~deb8u1","52.9.0esr-1~deb9u1","60.0.1esr-1","60.0.1esr-2","60.0.2esr-1","60.0esr-1","60.1.0esr-1","60.1.0esr-2","60.1.0esr-3","60.2.0esr-1~deb9u1"],"bundled":4},{"source":"osv","ecosystem":"Debian:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1-2~deb9u1"}]}],"versions":["1.5-4","1.5.0.2-1","1.5.0.2-2","1.5.0.2-3","1.5.0.4-1","1.5.0.4-2","1.5.0.4-3","1.5.0.5-1","1.5.0.7-1","1.5.0.7-2","1:52.4.0-1","1:52.4.0-1~deb7u1","1:52.4.0-1~deb8u1","1:52.4.0-1~deb9u1","1:52.4.0-2~exp1","1:52.5.0-1","1:52.5.0-1~deb7u1","1:52.5.0-1~deb8u1","1:52.5.0-1~deb9u1","1:52.5.2-1","1:52.5.2-1~deb7u1","1:52.5.2-2","1:52.5.2-2~deb8u1","1:52.5.2-2~deb9u1","1:52.6.0-1","1:52.6.0-1+alpha.1","1:52.6.0-1+alpha.2","1:52.6.0-1~deb7u1","1:52.6.0-1~deb8u1","1:52.6.0-1~deb9u1","1:52.7.0-1","1:52.7.0-1~deb7u1","1:52.7.0-1~deb8u1","1:52.7.0-1~deb9u1","1:52.8.0-1","1:52.8.0-1~deb7u1","1:52.8.0-1~deb8u1","1:52.8.0-1~deb9u1","1:52.9.0-1","1:52.9.1-1","1:52.9.1-1~deb8u1","1:52.9.1-1~deb9u1","1:58.0~b3-1","1:60.0-1","1:60.0-2","1:60.0-2~deb9u1","1:60.0-3","1:60.0-3~deb9u1","1:60.0~b10-1","1:60.0~b2-1","1:60.0~b3-1","1:60.0~b4-1","1:60.0~b5-1","1:60.0~b6-1","1:60.0~b9-1","1:60.0~b9-2","1:60.2.1-1"],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el7_5"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.0-1.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-5.el6"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:60.2.1-4.el7_5"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1+build1-0ubuntu0.14.04.2"}]}],"versions":["1:24.0+build1-0ubuntu1","1:24.0+build1-0ubuntu2","1:24.1.1+build1-0ubuntu0.13.10.1","1:24.1.1+build1-0ubuntu1","1:24.2.0+build1-0ubuntu1","1:24.4.0+build1-0ubuntu1","1:24.5.0+build1-0ubuntu0.14.04.1","1:24.6.0+build1-0ubuntu0.14.04.1","1:31.0+build1-0ubuntu0.14.04.1","1:31.1.1+build1-0ubuntu0.14.04.1","1:31.1.2+build1-0ubuntu0.14.04.1","1:31.2.0+build2-0ubuntu0.14.04.1","1:31.3.0+build1-0ubuntu0.14.04.1","1:31.4.0+build1-0ubuntu0.14.04.1","1:31.5.0+build1-0ubuntu0.14.04.1","1:31.6.0+build1-0ubuntu0.14.04.1","1:31.7.0+build1-0ubuntu0.14.04.1","1:31.8.0+build1-0ubuntu0.14.04.1","1:38.2.0+build1-0ubuntu0.14.04.1","1:38.3.0+build1-0ubuntu0.14.04.1","1:38.4.0+build3-0ubuntu0.14.04.1","1:38.5.1+build2-0ubuntu0.14.04.1","1:38.6.0+build1-0ubuntu0.14.04.1","1:38.7.2+build1-0ubuntu0.14.04.1","1:38.8.0+build1-0ubuntu0.14.04.1","1:45.2.0+build1-0ubuntu0.14.04.3","1:45.3.0+build1-0ubuntu0.14.04.4","1:45.4.0+build1-0ubuntu0.14.04.1","1:45.5.1+build1-0ubuntu0.14.04.1","1:45.7.0+build1-0ubuntu0.14.04.1","1:45.8.0+build1-0ubuntu0.14.04.1","1:52.1.1+build1-0ubuntu0.14.04.1","1:52.2.1+build1-0ubuntu0.14.04.1","1:52.3.0+build1-0ubuntu0.14.04.1","1:52.4.0+build1-0ubuntu0.14.04.2","1:52.5.0+build1-0ubuntu0.14.04.1","1:52.6.0+build1-0ubuntu0.14.04.1","1:52.7.0+build1-0ubuntu0.14.04.1","1:52.8.0+build1-0ubuntu0.14.04.1","1:52.9.1+build3-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"62.0+build2-0ubuntu0.16.04.3"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2","54.0+build3-0ubuntu0.16.04.1","55.0.1+build2-0ubuntu0.16.04.2","55.0.2+build1-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.2","57.0+build4-0ubuntu0.16.04.5","57.0+build4-0ubuntu0.16.04.6","57.0.1+build2-0ubuntu0.16.04.1","57.0.3+build1-0ubuntu0.16.04.1","57.0.4+build1-0ubuntu0.16.04.1","58.0+build6-0ubuntu0.16.04.1","58.0.1+build1-0ubuntu0.16.04.1","58.0.2+build1-0ubuntu0.16.04.1","59.0+build5-0ubuntu0.16.04.1","59.0.1+build1-0ubuntu0.16.04.1","59.0.2+build1-0ubuntu0.16.04.1","59.0.2+build1-0ubuntu0.16.04.3","60.0+build2-0ubuntu0.16.04.1","60.0.1+build2-0ubuntu0.16.04.1","60.0.2+build1-0ubuntu0.16.04.1","61.0+build3-0ubuntu0.16.04.2","61.0.1+build1-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1+build1-0ubuntu0.16.04.4"}]}],"versions":["1:38.3.0+build1-0ubuntu2","1:38.5.1+build2-0ubuntu1","1:38.6.0+build1-0ubuntu1","1:38.7.2+build1-0ubuntu0.16.04.1","1:38.8.0+build1-0ubuntu0.16.04.1","1:45.2.0+build1-0ubuntu0.16.04.1","1:45.3.0+build1-0ubuntu0.16.04.2","1:45.4.0+build1-0ubuntu0.16.04.1","1:45.5.1+build1-0ubuntu0.16.04.1","1:45.7.0+build1-0ubuntu0.16.04.1","1:45.8.0+build1-0ubuntu0.16.04.1","1:52.1.1+build1-0ubuntu0.16.04.1","1:52.2.1+build1-0ubuntu0.16.04.1","1:52.3.0+build1-0ubuntu0.16.04.1","1:52.4.0+build1-0ubuntu0.16.04.2","1:52.5.0+build1-0ubuntu0.16.04.1","1:52.6.0+build1-0ubuntu0.16.04.1","1:52.7.0+build1-0ubuntu0.16.04.1","1:52.8.0+build1-0ubuntu0.16.04.1","1:52.9.1+build3-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:60.2.1+build1-0ubuntu0.18.04.2"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"firefox esr"},{"vendor":"mozilla","product":"firefox_esr"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2018-20/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1468523","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Permissions Required","Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-21/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2018-25/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-18499","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h7hh-7f6j-x9mh"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-18499","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2692","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1510816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625526","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625528","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2692.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-16541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16541","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2017-16541","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12376","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12376","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12376","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12376","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12377","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12377","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12377","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12378","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12378","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12378","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12379","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12379","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12379","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-18499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1849971","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-18499","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-18499","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2693","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2693.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3403","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632062","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3403.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12383","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12383","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2018-12383","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12385","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-23/#CVE-2018-12385","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3458","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3458.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-18499","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/#CVE-2018-18499","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-25/#CVE-2018-18499","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-18499","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:00:00Z","modified":"2024-08-05T11:08:21.929Z","updated_at":"2026-11-02T14:35:11.426178Z"}],"euvd":[{"id":"EUVD-2018-10224","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:00:00Z","modified":"2024-08-05T11:08:21Z","updated_at":"2026-11-03T02:39:36.317092Z"}],"ghsa":[{"id":"GHSA-h7hh-7f6j-x9mh","title":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta...","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2022-05-14T01:30:06Z","modified":"2023-02-02T05:03:45Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:51:42.325662Z"}],"nvd":[{"id":"CVE-2018-18499","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:29:01.947Z","modified":"2026-06-17T01:47:24.523Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-346"],"updated_at":"2026-11-02T14:04:54.21788Z"}],"osv":[{"id":"CVE-2018-18499","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:29:01.947Z","modified":"2026-03-15T14:30:14.137801Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-18499","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:29:01.947Z","modified":"2026-10-23T18:03:02.751135872Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"RHSA-2018:2692","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T01:45:45Z","modified":"2026-06-26T10:38:45Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2693","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T01:45:38Z","modified":"2026-06-26T10:38:45Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:3403","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T01:47:34Z","modified":"2026-06-27T10:06:24Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:3458","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-16T01:47:40Z","modified":"2026-06-27T10:06:25Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-18499","description":"A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv=\"refresh\" on a page to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. This vulnerability affects Firefox \u003c 62, Firefox ESR \u003c 60.2, and Thunderbird \u003c 60.2.1.","status":"published","published":"2019-02-28T18:29:00Z","modified":"2026-04-22T11:49:26.510522Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1571-1","title":"firefox-esr - security update","status":"published","published":"2018-11-07T00:00:00Z","modified":"2026-03-09T01:20:05.817725Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1575-1","title":"thunderbird - security update","status":"published","published":"2018-11-12T00:00:00Z","modified":"2026-03-09T01:19:18.058926Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4287-1","title":"firefox-esr - security update","status":"published","published":"2018-09-07T00:00:00Z","modified":"2026-03-09T02:11:40.825872Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4327-1","title":"thunderbird - security update","status":"published","published":"2018-10-25T00:00:00Z","modified":"2026-03-09T02:08:34.082198Z","updated_at":"2026-11-02T15:46:16.862196Z"}]}}