Vulnerability CVE-2018-12391

Vulnerability Name:

CVE-2018-12391 (CCN-151891)

Assigned:

2018-10-23

Published:

2018-10-23

Updated:

2020-08-24

Summary:

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access.
Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-863

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2018-12391

Source: BID
Type: Third Party Advisory, VDB Entry
105718

Source: CCN
Type: BID-105718
Mozilla Firefox and Firefox ESR Multiple Security Vulnerabilities

Source: BID
Type: Third Party Advisory, VDB Entry
105769

Source: CCN
Type: BID-105769
Mozilla Thunderbird MFSA2018-28 Multiple Security Vulnerabilities

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1041944

Source: CONFIRM
Type: Issue Tracking, Permissions Required, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1478843

Source: XF
Type: UNKNOWN
firefox-cve201812391-info-disc(151891)

Source: GENTOO
Type: Third Party Advisory
GLSA-201811-13

Source: CCN
Type: Mozilla Foundation Security Advisory 2018-26
Security vulnerabilities fixed in Firefox 63

Source: CCN
Type: Mozilla Foundation Security Advisory 2018-27
Security vulnerabilities fixed in Firefox ESR 60.3

Source: CONFIRM
Type: Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/

Source: CONFIRM
Type: Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-27/

Source: CONFIRM
Type: Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-28/

Vulnerable Configuration:

Configuration 1:

cpe:/a:mozilla:firefox:*:*:*:*:*:*:*:* (Version < 63.0)

OR cpe:/a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (Version < 60.3)

OR cpe:/a:mozilla:thunderbird:*:*:*:*:*:*:*:* (Version < 60.3)

AND

cpe:/o:google:android:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mozilla:firefox_esr:60.2.0:*:*:*:*:*:*:*

OR cpe:/a:mozilla:firefox:62.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:51577	P	Security update for containerd (Important)	2022-12-13
oval:org.opensuse.security:def:645	P	Security update for php7 (Moderate) (in QA)	2022-10-04
oval:org.opensuse.security:def:201812391	V	CVE-2018-12391	2022-09-02
oval:org.opensuse.security:def:4640	P	Security update for the Linux Kernel (Live Patch 20 for SLE 12 SP5) (Important)	2022-07-06
oval:org.opensuse.security:def:3546	P	libICE6-1.0.8-12.1 on GA media (Moderate)	2022-06-28
oval:org.opensuse.security:def:95176	P	MozillaThunderbird-91.8.0-150200.8.65.1 on GA media (Moderate)	2022-06-22
oval:org.opensuse.security:def:4620	P	Security update for the Linux Kernel (Live Patch 21 for SLE 12 SP5) (Important)	2022-06-06
oval:org.opensuse.security:def:4612	P	Security update for the Linux Kernel (Live Patch 28 for SLE 12 SP5) (Important)	2022-05-23
oval:org.opensuse.security:def:4685	P	Security update for the Linux Kernel (Live Patch 23 for SLE 12 SP5) (Critical)	2022-02-16
oval:org.opensuse.security:def:64678	P	Security update for apache2 (Important)	2022-01-17
oval:org.opensuse.security:def:111905	P	MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:111899	P	MozillaFirefox-92.0-1.2 on GA media (Moderate)	2022-01-17
oval:org.opensuse.security:def:4730	P	Security update for the Linux RT Kernel (Important)	2021-12-10
oval:org.opensuse.security:def:1137	P	Security update for the Linux Kernel (Important)	2021-11-16
oval:org.opensuse.security:def:105476	P	MozillaFirefox-92.0-1.2 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:105478	P	MozillaThunderbird-91.1.1-1.1 on GA media (Moderate)	2021-10-01
oval:org.opensuse.security:def:66933	P	Security update for gd (Moderate)	2021-09-27
oval:org.opensuse.security:def:71352	P	openssh-7.9p1-4.7 on GA media (Moderate)	2021-09-21
oval:org.opensuse.security:def:64765	P	Security update for ghostscript (Critical)	2021-09-15
oval:org.opensuse.security:def:70289	P	Security update for libesmtp (Important)	2021-09-03
oval:org.opensuse.security:def:47794	P	libtasn1-4.9-3.5.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47987	P	cyrus-sasl-2.1.26-8.7.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47658	P	krb5-1.12.5-40.28.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48119	P	libgraphite2-3-1.3.1-10.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48211	P	libunwind-1.1-11.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47659	P	krb5-appl-clients-1.0.3-1.2 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47673	P	libXdmcp6-1.1.1-12.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:1732	P	open-vm-tools-desktop-11.2.5-1.17 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:101020	P	minicom-2.7.1-1.19 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1773	P	Security update for MozillaThunderbird (Important)	2021-07-22
oval:org.opensuse.security:def:68012	P	Security update for the Linux Kernel (Live Patch 16 for SLE 15 SP1) (Important)	2021-07-14
oval:org.opensuse.security:def:66841	P	Security update for freeradius-server (Moderate)	2021-06-23
oval:org.opensuse.security:def:48359	P	DirectFB-1.7.1-6.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48719	P	freerdp-1.0.2-7.9 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48573	P	libzip2-0.11.1-12.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48784	P	libFLAC++6-32bit-1.3.0-11.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48657	P	yast2-3.1.206-36.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48815	P	raptor-2.0.10-3.67 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48886	P	telepathy-gabble-0.18.3-5.7 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:73624	P	Security update for graphviz (Critical)	2021-05-19
oval:org.opensuse.security:def:68112	P	Security update for the Linux Kernel (Live Patch 14 for SLE 15 SP1) (Important)	2021-03-17
oval:org.opensuse.security:def:52026	P	Security update for python (Moderate)	2021-03-16
oval:org.opensuse.security:def:51743	P	Security update for openldap2 (Important)	2021-03-03
oval:org.opensuse.security:def:51471	P	Security update for mutt (Important)	2020-12-07
oval:org.opensuse.security:def:90092	P	MozillaThunderbird-60.6.1-3.28.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:71465	P	cups-filters-1.25.0-1.107 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2515	P	MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:94307	P	MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:103747	P	MozillaThunderbird-60.6.1-3.28.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63563	P	MozillaThunderbird-60.6.1-3.28.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:107686	P	MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:117201	P	MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:63604	P	MozillaThunderbird-68.8.0-3.80.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2474	P	MozillaThunderbird-60.6.1-3.28.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:5590	P	Security update for MozillaThunderbird (Important)	2020-12-02
oval:org.opensuse.security:def:4745	P	Initial update for kernel-azure (Moderate)	2020-12-02
oval:org.opensuse.security:def:4764	P	Security update for ovmf (Moderate)	2020-12-02
oval:org.opensuse.security:def:4894	P	Security update for postgresql10 (Important)	2020-12-02
oval:org.opensuse.security:def:4837	P	Security update for postgresql10 (Moderate)	2020-12-02
oval:org.opensuse.security:def:4901	P	Security update for libvirt (Important)	2020-12-02
oval:org.opensuse.security:def:4862	P	Security update for freeradius-server (Moderate)	2020-12-02
oval:org.opensuse.security:def:4908	P	Security update for xen (Important)	2020-12-02
oval:org.opensuse.security:def:4921	P	Security update for skopeo (Moderate)	2020-12-02
oval:org.opensuse.security:def:5559	P	Security update for nodejs8 (Important)	2020-12-02
oval:org.opensuse.security:def:52297	P	Security update for mariadb (Moderate)	2020-12-01
oval:org.opensuse.security:def:50903	P	Security update for glibc (Important)	2020-12-01
oval:org.opensuse.security:def:52134	P	Security update for libssh2_org (Moderate)	2020-12-01
oval:org.opensuse.security:def:25523	P	Security update for dpdk (Moderate)	2020-12-01
oval:org.opensuse.security:def:26360	P	Security update for MozillaThunderbird (Moderate)	2020-12-01
oval:org.opensuse.security:def:52333	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:50925	P	Security update for unbound (Important)	2020-12-01
oval:org.opensuse.security:def:25664	P	Security update for ImageMagick (Moderate)	2020-12-01
oval:org.opensuse.security:def:25576	P	Security update for the Linux Kernel (Important)	2020-12-01
oval:org.opensuse.security:def:50119	P	apache2-mod_php7 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52414	P	Security update for librepo (Important)	2020-12-01
oval:org.opensuse.security:def:51063	P	Security update for cni-plugins (Moderate)	2020-12-01
oval:org.opensuse.security:def:25678	P	Security update for kernel-firmware (Important)	2020-12-01
oval:org.opensuse.security:def:24960	P	Security update for MozillaFirefox (Important)	2020-12-01
oval:org.opensuse.security:def:50173	P	MozillaThunderbird on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:24949	P	Security update for postgresql10 (Moderate)	2020-12-01
oval:org.opensuse.security:def:51300	P	Security update for SDL (Moderate)	2020-12-01
oval:org.opensuse.security:def:25722	P	Security update for ovmf (Low)	2020-12-01
oval:org.opensuse.security:def:25024	P	Security update for nmap (Important)	2020-12-01
oval:org.opensuse.security:def:50902	P	Security update for icu (Important)	2020-12-01
oval:org.opensuse.security:def:50160	P	libpskc-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25151	P	Security update for file-roller (Low)	2020-12-01
oval:org.opensuse.security:def:50214	P	MozillaThunderbird on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25232	P	Security update for sudo (Important)	2020-12-01
oval:org.opensuse.security:def:26395	P	Security update for MozillaThunderbird (Important)	2020-12-01
oval:org.opensuse.security:def:53690	P	Security update for python-pip (Moderate)	2020-12-01
oval:org.opensuse.security:def:25289	P	Security update for grub2 (Important)	2020-12-01
oval:org.opensuse.security:def:73506	P	jcl-over-slf4j on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:52225	P	Security update for rubygem-activesupport-5_1 (Critical)	2020-12-01
oval:org.opensuse.security:def:53764	P	Security update for MozillaThunderbird (Important)	2020-12-01
oval:org.opensuse.security:def:70184	P	osc on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:25373	P	Security update for libX11 (Important)	2020-12-01
oval:com.ubuntu.xenial:def:2018123910000000	V	CVE-2018-12391 on Ubuntu 16.04 LTS (xenial) - medium.	2019-02-28
oval:com.ubuntu.bionic:def:201812391000	V	CVE-2018-12391 on Ubuntu 18.04 LTS (bionic) - medium.	2019-02-28
oval:com.ubuntu.cosmic:def:201812391000	V	CVE-2018-12391 on Ubuntu 18.10 (cosmic) - medium.	2019-02-28
oval:com.ubuntu.cosmic:def:2018123910000000	V	CVE-2018-12391 on Ubuntu 18.10 (cosmic) - medium.	2019-02-28
oval:com.ubuntu.trusty:def:201812391000	V	CVE-2018-12391 on Ubuntu 14.04 LTS (trusty) - medium.	2019-02-28
oval:com.ubuntu.bionic:def:2018123910000000	V	CVE-2018-12391 on Ubuntu 18.04 LTS (bionic) - medium.	2019-02-28
oval:com.ubuntu.xenial:def:201812391000	V	CVE-2018-12391 on Ubuntu 16.04 LTS (xenial) - medium.	2019-02-28

BACK