PT-2018-13816 · Giorgio Maone+1 · Noscript Classic+1

Published 2018-09-13 · Updated 2019-10-03 · CVE-2018-16983

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NoScript Classic versions prior to 5.1.8.7 Tor Browser versions 7.x

Description The issue allows attackers to bypass script blocking by utilizing the text/html;/json Content-Type value.

Recommendations For NoScript Classic versions prior to 5.1.8.7, update to version 5.1.8.7 or later. For Tor Browser versions 7.x, consider updating NoScript Classic to version 5.1.8.7 or later as a temporary workaround, or update Tor Browser to a version that includes the fixed NoScript Classic.

Fix

Related Identifiers

CVE-2018-16983

Affected Products

Noscript Classic

Tor Browser

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-16983 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16983 · Vendor Advisory
• https://twitter.com/Zerodium/status/1039127214602641409 · Note
• https://noscript.net/getit#classic · Note
• https://zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter · Note