Home

CVE-2018-12391

Description

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.547

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities affected in Mozilla Firefox (x64) 62.0.3Windows
Multiple vulnerabilities affected in Mozilla Firefox ESR (x64) 60.2.2Windows
Multiple vulnerabilities affected in Mozilla Firefox ESR 60.2.2Windows
Multiple vulnerabilities affected in Mozilla Thunderbird 60.2.1Windows
Multiple vulnerabilities affected in Mozilla_Firefox 62.0.3Windows
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 62.0.3Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 60.2.2Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 60.2.2Mac
Vulnerabilities CVE-2018-12389,CVE-2018-12390,CVE-2018-12391,CVE-2018-12392 are affected in Mozilla Thunderbird for Mac 60.2.1Mac

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-343016Mozilla Firefox (x64) (132.0.2)
PATCH-310844Mozilla Firefox ESR (x64) (60.9.0)
PATCH-310843Mozilla Firefox ESR (60.9.0)
PATCH-308341Mozilla Thunderbird (60.3.0)
PATCH-343015Mozilla Firefox (132.0.2)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234