CVE-2018-12391
This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 2.09% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- mozilla/firefox · mozilla/firefox esr · mozilla/thunderbird
- Source
- security@mozilla.org
References
- http://www.securityfocus.com/bid/105718Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/105769Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1478843Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201811-13Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-28/Vendor Advisory
- http://www.securityfocus.com/bid/105718Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/105769Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041944Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1478843Issue Tracking, Permissions Required, Vendor Advisory
- https://security.gentoo.org/glsa/201811-13Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-28/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.