CVE-2018-12365 — Sensitive Information Exposure in Mozilla Firefox
Severity
6.5MEDIUMNVD
OSV8.8
EPSS
2.1%
top 16.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 18
Latest updateMay 14
Description
A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages11 packages
Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10, 18.04, Enterprise Linux 7.6, 7.5
🔴Vulnerability Details
6GHSA▶
GHSA-m35p-3hfp-7xr6: A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or intera↗2022-05-14
OSV▶
CVE-2018-12365: A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or intera↗2018-10-18
CVEList▶
CVE-2018-12365: A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or intera↗2018-10-18