Bug 1642186 (CVE-2018-12396)

Summary:	CVE-2018-12396 Mozilla: WebExtension content scripts can execute in disallowed contexts
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cschalle, gecko-bugs-nobody, jhorak, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-11-13 06:16:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1640852, 1640854, 1649195
Bug Blocks:	1640850

Description Doran Moppert 2018-10-23 22:08:07 UTC

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run.



External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12396

Comment 1 Doran Moppert 2018-10-23 22:08:17 UTC

Acknowledgments:

Name: the Mozilla project
Upstream: Rob Wu

Comment 2 errata-xmlrpc 2018-10-24 22:09:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3005 https://access.redhat.com/errata/RHSA-2018:3005

Comment 3 errata-xmlrpc 2018-10-24 22:10:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:3006 https://access.redhat.com/errata/RHSA-2018:3006