PT-2018-2991 · Mozilla+5 · Firefox+5

Wladimir Palant

·

Publicado

2018-05-09

·

Atualizado

2024-12-12

·

CVE-2018-5157

CVSS v2.0

7.6

Alta

VetorAV:N/AC:H/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.8 Firefox versions prior to 60
Description The issue allows a malicious site to bypass same-origin protections for the PDF viewer, potentially intercepting messages meant for the viewer. This could enable the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. The vulnerability is also described as being due to insufficient input validation in the Capture Handler component of Firefox ESR and Firefox browsers, which could allow a remote attacker to elevate their privileges.
Recommendations For Firefox ESR versions prior to 52.8, update to version 52.8 or later. For Firefox versions prior to 60, update to version 60 or later.

Correção

RCE

Information Disclosure

Origin Validation Error

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20CWE-200CWE-346

Identificadores relacionados

ALT-PU-2018-1787
ALT-PU-2018-1854
BDU:2019-03310
CESA-2018_1414
CESA-2018_1415
CVE-2018-5157
DLA-1376-1
DSA-4199-1
MGASA-2018-0248
MGASA-2018-0338
OPENSUSE-SU-2018_1212-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
RHSA-2018:1414
RHSA-2018:1415
RHSA-2018_1414
RHSA-2018_1415
SUSE-SU-2018:1319-1
SUSE-SU-2018:1334-1
SUSE-SU-2018:1334-2
SUSE-SU-2018:2298-1
SUSE-SU-2019:2872-1
USN-3645-1
USN-3645-2

Produtos afetados

Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu