CVE-2018-5164: Canonical Ubuntu Linux

Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days.

Content Security Policy (CSP) is not applied correctly to all parts of multipart content sent with the "multipart/x-mixed-replace" MIME type. This could allow for script to run where CSP should block it, allowing for cross-site scripting (XSS) and other attacks. This vulnerability affects Firefox < 60.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only; version 18.04 only
• Mozilla Firefox: before 60.0 (fixed in 60.0)

Published 2018-06-11. Last modified 2026-06-17.