CVE-2018-5173

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51747.5In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and CVE-2018-51756.1A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target CVE-2018-51766.1The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains CVE-2018-51777.5A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer CVE-2018-51788.1A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerabil CVE-2018-51797.5A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by u CVE-2018-51807.5A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability i CVE-2018-51817.5If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a CVE-2018-51827.5If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specif CVE-2018-51839.8Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer CVE-2018-51847.5Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Th CVE-2018-51856.5Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Th