VulnerableCode Package Details - pkg:alpm/archlinux/firefox@60.0.2-1

Vulnerabilities affecting this package (17)

Vulnerability	Summary	Fixed by
VCID-16e7-m2v5-bkc9 Aliases: CVE-2018-12369	WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension to gain full browser permissions.	61.0-1 Affected by 0 other vulnerabilities.
VCID-2acu-v7z8-f3eq Aliases: CVE-2018-12356	An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution.	61.0-1 Affected by 0 other vulnerabilities.
VCID-47xg-s8mr-p3d4 Aliases: CVE-2018-5188	Mozilla developers and community members Alex Gaynor, Christoph Diehl, Christian Holler, Jason Kratzer, David Major, Jon Coppeard, Nicolas B. Pierron, Jason Kratzer, Marcia Knous, and Ronald Crane reported memory safety bugs present in Firefox 60, Firefox ESR 60, Firefox ESR 52.8, and Thunderbird 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.	61.0-1 Affected by 0 other vulnerabilities.
VCID-6gd7-v2p1-wuc6 Aliases: CVE-2018-12366	An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output.	61.0-1 Affected by 0 other vulnerabilities.
VCID-7vn7-r8vs-zude Aliases: CVE-2018-12364	NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site. This allows for a malicious site to engage in cross-site request forgery (CSRF) attacks.	61.0-1 Affected by 0 other vulnerabilities.
VCID-8gnf-1b5b-ubcb Aliases: CVE-2018-12359	A buffer overflow can occur when rendering canvas content while adjusting the height and width of the <canvas> element dynamically, causing data to be written outside of the currently computed boundaries. This results in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-8kkp-b6ve-4ya2 Aliases: CVE-2018-5187	Mozilla developers and community members Christian Holler, Sebastian Hengst, Nils Ohlmeier, Jon Coppeard, Randell Jesup, Ted Campbell, Gary Kwong, and Jean-Yves Avenard reported memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.	61.0-1 Affected by 0 other vulnerabilities.
VCID-8wzx-662r-zqa2 Aliases: CVE-2018-12363	A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-9jye-dwy8-m7e7 Aliases: CVE-2018-12360	A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-cj59-5ypa-4ugj Aliases: CVE-2018-12362	An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-dhgu-amrx-abem Aliases: CVE-2018-12371	An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-e8a1-8h1f-cqh2 Aliases: CVE-2018-12361	An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash.	61.0-1 Affected by 0 other vulnerabilities.
VCID-gjfb-tqan-2qbx Aliases: CVE-2018-12365	A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files.	61.0-1 Affected by 0 other vulnerabilities.
VCID-hh79-j7tj-7qhc Aliases: CVE-2018-12358	Service workers can use redirection to avoid the tainting of cross-origin resources in some instances, allowing a malicious site to read responses which are supposed to be opaque.	61.0-1 Affected by 0 other vulnerabilities.
VCID-j8em-cfvw-5bba Aliases: CVE-2018-5186	Mozilla developers and community members Christian Holler, Jason Kratzer, Jon Coppeard, Randell Jesup, Ronald Crane, and Boris Zbarsky reported memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.	61.0-1 Affected by 0 other vulnerabilities.
VCID-mn5y-duvw-bba6 Aliases: CVE-2018-12367	In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work, PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer.	61.0-1 Affected by 0 other vulnerabilities.
VCID-vvs3-bevn-7ff3 Aliases: CVE-2018-12370	In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited if loaded by a malicious site while Reader mode is active, bypassing CSRF protections.	61.0-1 Affected by 0 other vulnerabilities.

Next non-vulnerable version	61.0-1
Latest non-vulnerable version	101.0-1
Risk	4.5

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T11:37:05.452977+00:00	Arch Linux Importer	Fixing	VCID-jhqn-7me5-47gm	https://security.archlinux.org/AVG-715	37.0.0
2025-07-31T11:35:22.985045+00:00	Arch Linux Importer	Affected by	VCID-2acu-v7z8-f3eq	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.955763+00:00	Arch Linux Importer	Affected by	VCID-hh79-j7tj-7qhc	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.928741+00:00	Arch Linux Importer	Affected by	VCID-8gnf-1b5b-ubcb	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.899431+00:00	Arch Linux Importer	Affected by	VCID-9jye-dwy8-m7e7	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.871491+00:00	Arch Linux Importer	Affected by	VCID-e8a1-8h1f-cqh2	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.842345+00:00	Arch Linux Importer	Affected by	VCID-cj59-5ypa-4ugj	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.812519+00:00	Arch Linux Importer	Affected by	VCID-8wzx-662r-zqa2	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.782563+00:00	Arch Linux Importer	Affected by	VCID-7vn7-r8vs-zude	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.751897+00:00	Arch Linux Importer	Affected by	VCID-gjfb-tqan-2qbx	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.723415+00:00	Arch Linux Importer	Affected by	VCID-6gd7-v2p1-wuc6	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.693366+00:00	Arch Linux Importer	Affected by	VCID-mn5y-duvw-bba6	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.664116+00:00	Arch Linux Importer	Affected by	VCID-16e7-m2v5-bkc9	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.637689+00:00	Arch Linux Importer	Affected by	VCID-vvs3-bevn-7ff3	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.607365+00:00	Arch Linux Importer	Affected by	VCID-dhgu-amrx-abem	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.577158+00:00	Arch Linux Importer	Affected by	VCID-j8em-cfvw-5bba	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.550002+00:00	Arch Linux Importer	Affected by	VCID-8kkp-b6ve-4ya2	https://security.archlinux.org/AVG-727	37.0.0
2025-07-31T11:35:22.520538+00:00	Arch Linux Importer	Affected by	VCID-47xg-s8mr-p3d4	https://security.archlinux.org/AVG-727	37.0.0