Skip to content
Fencer Vulns
medium 5.3

CVE-2018-5173 json

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed.

published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-16958

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This can be used to obscure the file extension of potentially executable files from user view in the panel. Note: the dialog to open the file will show the full, correct filename and whether it is executable or not. This vulnerability affects Firefox < 60.

Patch / fix

  • Mozilla Firefox 60
  • firefox Ubuntu 14.04 LTS 60.0+build2-0ubuntu0.14.04.1
  • firefox Ubuntu 16.04 LTS 60.0+build2-0ubuntu0.16.04.1
  • firefox Ubuntu 18.04 LTS 60.0+build2-0ubuntu1

ubuntu advisories UBUNTU-CVE-2018-5173

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • MozillaFirefox SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +17 more 68.2.0-109.95.2

suse advisories SUSE-SU-2019:2872-1

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1

  • firefox Arch Linux 60.0-1

arch linux advisories AVG-693

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-5173 updated cvss 6.1

Mozilla: File name spoofing of Downloads panel with Unicode characters

  • Red Hat Enterprise Linux 6 firefox, thunderbird Red Hat Enterprise Linux 7 firefox, thunderbird
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.78% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Mozilla Firefox

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.