CVE-2018-12400

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In private browsing mode on Firefox for Android, favicons are cached in the cache/icons folder as they are in non-private mode. This allows information leakage of sites visited during private browsing sessions. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 63

References

http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1448305Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
http://www.securityfocus.com/bid/105721Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1448305Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory

Timeline

Published: Feb 28, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-124017.5Some special resource URIs will cause a non-exploitable crash if loaded with optional parameters following a '?' in the parsed string. This CVE-2018-124026.5The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are lo CVE-2018-124035.3If a site is loaded over a HTTPS connection but loads a favicon resource over HTTP, the mixed content warning is not displayed to users. Thi CVE-2018-124045.9A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant o CVE-2018-124059.8Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed e CVE-2018-124068.8Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory cor CVE-2018-124079.8A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the CVE-2018-124087.5The BusinessWorks engine component of TIBCO Software Inc.'s TIBCO ActiveMatrix BusinessWorks, TIBCO ActiveMatrix BusinessWorks for z/Linux, CVE-2018-124096.1The SOAP Admin API component of TIBCO Software Inc.'s TIBCO Silver Fabric contains a vulnerability that may allow reflected cross-site scrip CVE-2018-12418.8Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP pa CVE-2018-124109.8The web server component of TIBCO Software Inc's Spotfire Statistics Services contains multiple vulnerabilities that may allow the remote ex CVE-2018-124118.8The administrative daemon (tibdgadmind) of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition, TIBCO ActiveSpaces - Developer Edit