vulnerability

MFSA2018-11 Firefox: Security vulnerabilities fixed in Firefox 60 (CVE-2018-5173)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:N)

Published

May 9, 2018

Added

May 10, 2018

Modified

Mar 27, 2026

Description

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.

Solution

mozilla-firefox-upgrade-60_0

References

CVE-2018-5173
https://attackerkb.com/topics/CVE-2018-5173
CWE-20
EUVD-EUVD-2018-16958
http://www.mozilla.org/security/announce/2018/mfsa2018-11.html
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-16958

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report