CVE-2018-5133: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This stored preference is also executed whenever an EME video player plugin displays a CDM-disabled message as a notification message. This vulnerability affects Firefox < 59.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only
• Mozilla Firefox: before 59.0 (fixed in 59.0)

Published 2018-06-11. Last modified 2026-06-17.