Vulnerability Description
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 63.0 |
| Mozilla | Firefox Esr | < 60.3 |
| Mozilla | Thunderbird | < 60.3 |
| Android | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/105718Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/105769Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041944Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1478843Issue TrackingPermissions RequiredVendor Advisory
- https://security.gentoo.org/glsa/201811-13Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-28/Vendor Advisory
- http://www.securityfocus.com/bid/105718Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/105769Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1041944Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1478843Issue TrackingPermissions RequiredVendor Advisory
- https://security.gentoo.org/glsa/201811-13Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-26/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-27/Vendor Advisory
FAQ
What is CVE-2018-12391?
CVE-2018-12391 is a vulnerability with a CVSS score of 8.8 (HIGH). During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this iss...
How severe is CVE-2018-12391?
CVE-2018-12391 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-12391?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Google Android.