CVE-2018-12358

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are supposed to be opaque. This vulnerability affects Firefox < 61.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 61

References

http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1467852Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
https://usn.ubuntu.com/3705-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1467852Issue Tracking, Permissions Required
https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
https://usn.ubuntu.com/3705-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory

Timeline

Published: Oct 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-123598.8A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing da CVE-2018-123608.8A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. CVE-2018-123618.8An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics c CVE-2018-123628.8An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a CVE-2018-123638.8A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document CVE-2018-123648.8NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 r CVE-2018-123656.5A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent CVE-2018-123666.5An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This cou CVE-2018-123674.3In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure pre CVE-2018-123688.1Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from CVE-2018-123699.8WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension t CVE-2018-12379.8Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (L