CVE-2018-12382
Summary
| CVE | CVE-2018-12382 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-18 13:29:00 UTC |
| Updated | 2018-12-06 18:13:00 UTC |
| Description | The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before the loaded domain name, scrolling the loaded domain out of view to the right. This can lead to user confusion. *This vulnerability only affects Firefox for Android < 62.* |
Risk And Classification
Problem Types: CWE-20
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 1479311 - (CVE-2018-12382) Firefox for Android - AddressBar Spoofing using specially-crafted javascript: URL opened in a new tab | CONFIRM | bugzilla.mozilla.org | Exploit, Issue Tracking, Vendor Advisory |
| Security vulnerabilities fixed in Firefox 62 — Mozilla | CONFIRM | www.mozilla.org | Vendor Advisory |
| Mozilla Firefox Multiple Bugs Let Remote Users Spoof the Address Bar, Bypass Security Restrictions, and Execute Arbitrary Code - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Mozilla Firefox MFSA2018-20 Multiple Security Vulnerabilities | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 690611 Free Berkeley Software Distribution (FreeBSD) Security Update for mozilla (c96d416a-eae7-4d5d-bc84-40deca9329fb)