Malicious PDF can inject JavaScript into PDF Viewer

HIGH 8.8CVE-2018-5158 · GHSA-7jg2-jgv3-fmr4 · Published 11/06/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
firefox mozilla	`< 52.8.0< 60.0`	`52.8.060.0`
pdfjs-dist npm	`≥ 2.0.0, < 2.0.550< 1.10.100`	`2.0.5501.10.100`

Description

The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-5158 · ADVISORY
mozilla/pdf.js#9659 · WEB
mozilla/pdf.js commit 2dc4af5 · WEB
access.redhat.com/errata/RHSA-2018:1414 · WEB
access.redhat.com/errata/RHSA-2018:1415 · WEB
bugzilla.mozilla.org/show_bug.cgi · WEB
mozilla/pdf.js · PACKAGE
lists.debian.org/debian-lts-announce/2018/05/msg00007.html · WEB
security.gentoo.org/glsa/201810-01 · WEB
usn.ubuntu.com/3645-1 · WEB
debian.org/security/2018/dsa-4199 · WEB
mozilla.org/security/advisories/mfsa2018-11 · WEB
mozilla.org/security/advisories/mfsa2018-12 · WEB
securityfocus.com/bid/104136 · WEB
securitytracker.com/id/1040896 · WEB
usn.ubuntu.com/3645-1 · Third Party Advisory
mozilla.org/security/advisories/mfsa2018-11 · Vendor Advisory
mozilla.org/security/advisories/mfsa2018-12 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free