CVE-2018-5175

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target website contains an HTML injection flaw an attacker could inject a reference to a copy of the "require.js" library that is part of Firefox's Developer Tools, and then use a known technique using that library to bypass the CSP restrictions on executing injected scripts. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51766.1The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file containsCVE-2018-51777.5A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a bufferCVE-2018-51788.1A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerabilCVE-2018-51797.5A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by uCVE-2018-51807.5A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability iCVE-2018-51817.5If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open aCVE-2018-51827.5If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specifCVE-2018-51839.8Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer CVE-2018-51847.5Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51856.5Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51869.8Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort thaCVE-2018-51879.8Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that wit