CVE-2018-12395: canonical ubuntu_linux
Vulnerability summary
CVE-2018-12395 is a high (CVSS 7.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 2.85% chance of exploitation in the next 30 days, higher than 86.7% of scored vulnerabilities.
Severe, CVSS 7.5 (NVD); no exploitation reported by the 5 checked sources; EPSS 3% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 12 · Related 7Timeline
- 28-02-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.85%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.85% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_eus7.5
- enterprise_linux_workstation6.0 | 7.0
Ubuntu3 products
- firefox< 63.0+build2-0ubuntu0.14.04.2 | < 63.0+build2-0ubuntu0.16.04.2 | < 63.0+build2-0ubuntu0.18.04.2
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
Debian2 products
- firefox-esr< 60.3.0esr-1
- debian_linuxEOL8.0 | 9.0
Mozilla2 products
- firefox≥ unspecified, < 63 | < 63.0
- firefox esr≥ unspecified, < 60.3 | < 60.3
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 18.10
5 vendors · 12 products
References
17 links
- lists.debian.org/debian-lts-announce/2018/11/msg00008.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 17 references
- bugzilla.mozilla.org/show_bug.cgi?id=1467523X Refsource CONFIRMIssue TrackingPermissions RequiredVendor Advisory