CVE-2018-12383: Canonical Ubuntu Linux

Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days.

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Firefox 58. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Firefox < 62, Firefox ESR < 60.2.1, and Thunderbird < 60.2.1.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Mozilla Firefox: before 62.0 (fixed in 62.0)
• Mozilla Firefox ESR: before 60.2.1 (fixed in 60.2.1)
• Mozilla Thunderbird: before 60.2.1 (fixed in 60.2.1)
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.5 only; version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2018-10-18. Last modified 2026-06-17.