PT-2018-2991 · Mozilla+5 · Firefox+5

Wladimir Palant · Published 2018-05-09 · Updated 2024-12-12 · CVE-2018-5157

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.8 Firefox versions prior to 60

Description The issue allows a malicious site to bypass same-origin protections for the PDF viewer, potentially intercepting messages meant for the viewer. This could enable the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. The vulnerability is also described as being due to insufficient input validation in the Capture Handler component of Firefox ESR and Firefox browsers, which could allow a remote attacker to elevate their privileges.

Recommendations For Firefox ESR versions prior to 52.8, update to version 52.8 or later. For Firefox versions prior to 60, update to version 60 or later.

Fix

RCE

Information Disclosure

Origin Validation Error

Weakness Enumeration

CWE-20

CWE-200

CWE-346

Related Identifiers

ALT-PU-2018-1787

ALT-PU-2018-1854

BDU:2019-03310

CESA-2018_1414

CESA-2018_1415

CVE-2018-5157

DLA-1376-1

DSA-4199-1

MGASA-2018-0248

MGASA-2018-0338

OPENSUSE-SU-2018_1212-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:1414

RHSA-2018:1415

RHSA-2018_1414

RHSA-2018_1415

SUSE-SU-2018:1319-1

SUSE-SU-2018:1334-1

SUSE-SU-2018:1334-2

SUSE-SU-2018:2298-1

SUSE-SU-2019:2872-1

USN-3645-1

USN-3645-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 1970

• https://osv.dev/vulnerability/SUSE-SU-2018:1334-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-11 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-07 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1334-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-5157 · Vendor Advisory
• https://mozilla.org/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0338 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2872-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5157 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1414 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5157 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0248 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4199-1 · Vendor Advisory