PT-2018-1348 · Mozilla+1 · Firefox+1

Khalil Zhani · Published 2018-01-23 · Updated 2024-12-12 · CVE-2018-5121

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 58

Description The issue is related to the incorrect rendering of some Tibetan characters in the address bar when using certain fonts on OS X. This can be exploited for domain name spoofing attacks when used as part of an Internationalized Domain Name (IDN). The attack only affects OS X operating systems, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider avoiding the use of Tibetan characters in the address bar or restricting access to potentially spoofed domains until the update is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-1178

BDU:2018-00863

CVE-2018-5121

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox

References · 1870

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5121 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5121 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00863 · Security Note
• https://suse.com/security/cve/CVE-2023-25728 · Note
• https://suse.com/security/cve/CVE-2022-31743 · Note
• https://suse.com/security/cve/CVE-2018-12392 · Note
• https://suse.com/security/cve/CVE-2024-5698 · Note
• https://suse.com/security/cve/CVE-2013-1701 · Note
• https://suse.com/security/cve/CVE-2024-5687 · Note
• https://suse.com/security/cve/CVE-2022-24713 · Note
• https://suse.com/security/cve/CVE-2014-8642 · Note
• https://suse.com/security/cve/CVE-2015-4516 · Note