CVE-2018-5119

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The reader view will display cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. This could allow access to content that should be restricted in reader view. This vulnerability affects Firefox < 58.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51215.3Low descenders on some Tibetan characters in several fonts on OS X are clipped when rendered in the addressbar. When used as part of an Inte CVE-2018-51229.8A potential integer overflow in the "DoCrypt" function of WebCrypto was identified. If a means was found of exploiting it, it could result i CVE-2018-51238.8A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.CVE-2018-51246.1Unsanitized output in the browser UI leaves HTML tags in place and can result in arbitrary code execution in Firefox before version 58.0.1.CVE-2018-51258.8Memory safety bugs were reported in Firefox 58 and Firefox ESR 52.6. Some of these bugs showed evidence of memory corruption and we presume CVE-2018-51269.8Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2018-51278.8A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash.CVE-2018-51289.8A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in CVE-2018-51298.6A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potential CVE-2018-51308.8When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is tri CVE-2018-51315.9Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" CVE-2018-51326.5The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could all