PT-2018-3044 · Mozilla+3 · Firefox+3

Abdulrahman Alqabandi · Published 2018-05-09 · Updated 2024-12-12 · CVE-2018-5172

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 60

Description The issue arises when a user pastes script content from the clipboard into the Live Bookmarks page or the PDF viewer while viewing RSS feeds or PDF files. This could allow a malicious site to socially engineer a user into copying and pasting malicious script content, which could then run with the context of either page. However, it does not allow for privilege escalation. The vulnerability can be exploited by a remote attacker using a specially crafted website to execute arbitrary code.

Recommendations For versions prior to 60, update to version 60 or later to resolve the issue. As a temporary workaround, consider avoiding the paste function in the Live Bookmarks page and the PDF viewer when viewing RSS feeds or PDF files from untrusted sources. Restrict access to these features to minimize the risk of exploitation.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

ALT-PU-2018-1787

ALT-PU-2018-1854

BDU:2019-03512

CVE-2018-5172

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:2872-1

USN-3645-1

USN-3645-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 1931

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-11 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2872-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5157 · Vendor Advisory
• https://usn.ubuntu.com/3645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5160 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5154 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3645-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5159 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5172 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5158 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5169 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5173 · Vendor Advisory