CVE-2018-5165

In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/104139	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040896	Third Party Advisory VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1451452	Exploit Issue Tracking Patch Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-11/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:x86:*

History

No history.

Information

Published : 2018-06-11 21:29

Updated : 2023-12-10 12:30

NVD link : CVE-2018-5165

Mitre link : CVE-2018-5165

CVE.ORG link : CVE-2018-5165

JSON object : View

Products Affected

mozilla

firefox

CWE

NVD-CWE-noinfo

{"id": "CVE-2018-5165", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-06-11T21:29:15.593", "references": [{"url": "http://www.securityfocus.com/bid/104139", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1040896", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1451452", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-11/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In 32-bit versions of Firefox, the Adobe Flash plugin setting for \"Enable Adobe Flash protected mode\" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60."}, {"lang": "es", "value": "En las versiones de 32 bits de Firefox, la configuraci\u00f3n del plugin de Adobe Flash para \"Activar el modo protegido de Adobe Flash\" est\u00e1 desactivada por defecto a pesar de que el sandbox de Adobe Flash est\u00e1 en realidad activado. El estado visualizado es el inverso de la configuraci\u00f3n correcta, lo que confunde al usuario. Esto podr\u00eda hacer que los usuarios seleccionen este ajuste con la intenci\u00f3n de activarlo y desactivar inadvertidamente las protecciones. Esta vulnerabilidad afecta a las versiones anteriores a la 60 de Firefox."}], "lastModified": "2020-09-11T16:45:53.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "BFABB84B-6975-4490-8ECA-A643359192A3", "versionEndExcluding": "60.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}