{"id":"CVE-2018-5124","aliases":["EUVD-2018-16910","GHSA-x85x-whmj-686x","UBUNTU-CVE-2018-5124","USN-3552-1"],"status":"published","title":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code...","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01013,"percentile":0.63464,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-01-30T00:00:00Z","modified":"2026-06-17T01:59:39Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"firefox","fixed_in":["58.0.1+build1-0ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"firefox","fixed_in":["58.0.1+build1-0ubuntu0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"firefox","fixed_in":["59.0.1+build1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.1+build1-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.2","52.0+build2-0ubuntu0.14.04.1","52.0.1+build2-0ubuntu0.14.04.1","52.0.2+build1-0ubuntu0.14.04.1","53.0+build6-0ubuntu0.14.04.1","53.0.2+build1-0ubuntu0.14.04.2","53.0.3+build1-0ubuntu0.14.04.2","54.0+build3-0ubuntu0.14.04.1","55.0.1+build2-0ubuntu0.14.04.2","55.0.2+build1-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.2","57.0+build4-0ubuntu0.14.04.4","57.0+build4-0ubuntu0.14.04.5","57.0.1+build2-0ubuntu0.14.04.1","57.0.3+build1-0ubuntu0.14.04.1","57.0.4+build1-0ubuntu0.14.04.1","58.0+build6-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.1+build1-0ubuntu0.16.04.1"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2","54.0+build3-0ubuntu0.16.04.1","55.0.1+build2-0ubuntu0.16.04.2","55.0.2+build1-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.2","57.0+build4-0ubuntu0.16.04.5","57.0+build4-0ubuntu0.16.04.6","57.0.1+build2-0ubuntu0.16.04.1","57.0.3+build1-0ubuntu0.16.04.1","57.0.4+build1-0ubuntu0.16.04.1","58.0+build6-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"59.0.1+build1-0ubuntu1"}]}],"versions":["56.0+build6-0ubuntu1","57.0.1+build2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.1+build1-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.2","52.0+build2-0ubuntu0.14.04.1","52.0.1+build2-0ubuntu0.14.04.1","52.0.2+build1-0ubuntu0.14.04.1","53.0+build6-0ubuntu0.14.04.1","53.0.2+build1-0ubuntu0.14.04.2","53.0.3+build1-0ubuntu0.14.04.2","54.0+build3-0ubuntu0.14.04.1","55.0.1+build2-0ubuntu0.14.04.2","55.0.2+build1-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.2","57.0+build4-0ubuntu0.14.04.4","57.0+build4-0ubuntu0.14.04.5","57.0.1+build2-0ubuntu0.14.04.1","57.0.3+build1-0ubuntu0.14.04.1","57.0.4+build1-0ubuntu0.14.04.1","58.0+build6-0ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.1+build1-0ubuntu0.16.04.1"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2","54.0+build3-0ubuntu0.16.04.1","55.0.1+build2-0ubuntu0.16.04.2","55.0.2+build1-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.2","57.0+build4-0ubuntu0.16.04.5","57.0+build4-0ubuntu0.16.04.6","57.0.1+build2-0ubuntu0.16.04.1","57.0.3+build1-0ubuntu0.16.04.1","57.0.4+build1-0ubuntu0.16.04.1","58.0+build6-0ubuntu0.16.04.1"]}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-05/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5124"},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2018-05"},{"url":"https://github.com/advisories/GHSA-x85x-whmj-686x"},{"url":"https://ubuntu.com/security/CVE-2018-5124","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3552-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5124","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-5124","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","status":"published","published":"2019-04-26T16:06:55Z","modified":"2024-08-05T05:26:46.992Z","updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2018-16910","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","status":"published","published":"2019-04-26T16:06:55Z","modified":"2024-08-05T05:26:46Z","updated_at":"2026-11-03T02:40:11.729267Z"}],"ghsa":[{"id":"GHSA-x85x-whmj-686x","title":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code...","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","status":"published","published":"2022-05-24T16:44:43Z","modified":"2024-04-04T00:11:28Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:49.472376Z"}],"nvd":[{"id":"CVE-2018-5124","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","status":"published","published":"2019-04-26T17:29:00.743Z","modified":"2026-06-17T01:59:39.877Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:57.307075Z"}],"osv":[{"id":"UBUNTU-CVE-2018-5124","description":"Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.","status":"published","published":"2018-01-30T00:00:00Z","modified":"2026-04-22T11:56:57.241462Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"USN-3552-1","title":"firefox vulnerability","description":"Johann Hofmann discovered that HTML fragments created for\nchrome-privileged documents were not properly sanitized. An attacker\ncould exploit this to execute arbitrary code. (CVE-2018-5124)\n","status":"published","published":"2018-01-31T16:53:56Z","modified":"2026-04-22T09:43:19.330674Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}