CVE-2018-12383

2018-09-0600:00:00

ubuntu.com

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

31.6%

JSON

If a user saved passwords before Firefox 58 and then later set a master
password, an unencrypted copy of these passwords is still accessible. This
is because the older stored password file was not deleted when the data was
copied to a new format starting in Firefox 58. The new master password is
added only on the new file. This could allow the exposure of stored
password data outside of user expectations. This vulnerability affects
Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfirefox< 62.0+build2-0ubuntu0.18.04.3UNKNOWN
ubuntu14.04noarchfirefox< 62.0+build2-0ubuntu0.14.04.3UNKNOWN
ubuntu16.04noarchfirefox< 62.0+build2-0ubuntu0.16.04.3UNKNOWN
ubuntu18.04noarchthunderbird< 1:60.2.1+build1-0ubuntu0.18.04.2UNKNOWN
ubuntu14.04noarchthunderbird< 1:60.2.1+build1-0ubuntu0.14.04.2UNKNOWN
ubuntu16.04noarchthunderbird< 1:60.2.1+build1-0ubuntu0.16.04.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	firefox	< 62.0+build2-0ubuntu0.18.04.3	UNKNOWN
ubuntu	14.04	noarch	firefox	< 62.0+build2-0ubuntu0.14.04.3	UNKNOWN
ubuntu	16.04	noarch	firefox	< 62.0+build2-0ubuntu0.16.04.3	UNKNOWN
ubuntu	18.04	noarch	thunderbird	< 1:60.2.1+build1-0ubuntu0.18.04.2	UNKNOWN
ubuntu	14.04	noarch	thunderbird	< 1:60.2.1+build1-0ubuntu0.14.04.2	UNKNOWN
ubuntu	16.04	noarch	thunderbird	< 1:60.2.1+build1-0ubuntu0.16.04.4	UNKNOWN