Vulnerabilities > CVE-2018-5165 - Unspecified vulnerability in Mozilla Firefox
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
LOW Availability impact
NONE Summary
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Nessus
NASL family MacOS X Local Security Checks NASL id MACOS_FIREFOX_60_0_0.NASL description The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 60. It is, therefore, affected by multiple critical and high severity vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 109867 published 2018-05-17 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109867 title Mozilla Firefox < 60 Multiple Critical Vulnerabilities (macOS) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_5AEFC41ED3044EC88C82824F84F08244.NASL description Mozilla Foundation reports : CVE-2018-5183: Backport critical security fixes in Skia CVE-2018-5154: Use-after-free with SVG animations and clip paths CVE-2018-5155: Use-after-free with SVG animations and text paths CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer CVE-2018-5159: Integer overflow and out-of-bounds write in Skia CVE-2018-5160: Uninitialized memory use by WebRTC encoder CVE-2018-5152: WebExtensions information leak through webRequest API CVE-2018-5153: Out-of-bounds read in mixed content websocket messages CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace CVE-2018-5166: WebExtension host permission bypass through filterReponseData CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger CVE-2018-5168: Lightweight themes can be installed without user interaction CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies CVE-2018-5176: JSON Viewer script injection CVE-2018-5177: Buffer overflow in XSLT during number formatting CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar CVE-2018-5151: Memory safety bugs fixed in Firefox 60 CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 last seen 2020-06-01 modified 2020-06-02 plugin id 109661 published 2018-05-10 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109661 title FreeBSD : mozilla -- multiple vulnerabilities (5aefc41e-d304-4ec8-8c82-824f84f08244) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-2872-1.NASL description This update for MozillaFirefox to 68.2.0 ESR fixes the following issues : Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738). Security issues fixed : CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429). CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738). CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738). CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738). CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738). CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738). CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738). CVE-2019-11763: Fixed an XSS bypass (bsc#1154738). CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738). Non-security issues fixed: Firefox 60.7 ESR changed the user interface language (bsc#1137990). Wrong Firefox GUI Language (bsc#1120374). Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235). Firefox hangs randomly when browsing and scrolling (bsc#1043008). Firefox stops loading page until mouse is moved (bsc#1025108). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 130450 published 2019-11-01 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/130450 title SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1) NASL family Windows NASL id MOZILLA_FIREFOX_60_0_0.NASL description The version of Mozilla Firefox installed on the remote Windows host is prior to 60. It is, therefore, affected by multiple critical and high severity vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 109869 published 2018-05-17 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/109869 title Mozilla Firefox < 60 Multiple Critical Vulnerabilities
References
- http://www.securityfocus.com/bid/104139
- http://www.securityfocus.com/bid/104139
- http://www.securitytracker.com/id/1040896
- http://www.securitytracker.com/id/1040896
- https://bugzilla.mozilla.org/show_bug.cgi?id=1451452
- https://bugzilla.mozilla.org/show_bug.cgi?id=1451452
- https://www.mozilla.org/security/advisories/mfsa2018-11/
- https://www.mozilla.org/security/advisories/mfsa2018-11/