Same-origin policy bypass in Mozilla Firefox - CVE-2018-5157

Vulnerability identifier: #VU12534

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-5157

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass same-origin policy on the target system.

The weakness exists due to improper input validation. A remote attacker can trick the victim into visiting a specially crafted website, bypass same-origin protections for the PDF viewer and cause a malicious site to intercept messages meant for the viewer and retrieve PDF files restricted to viewing by an authenticated user on a third-party website.

Mozilla Firefox
Firefox ESR
Gentoo Linux
Debian Linux
Arch Linux
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server

Update to version 60.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/

• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in Mozilla Firefox ESR
• OpenSUSE Linux update for Mozilla Firefox
• Debian update for firefox-esr
• Arch Linux update for firefox
• Red Hat update for Mozilla Firefox
• Red Hat update for Mozilla Firefox
• Gentoo update for Mozilla Firefox