En bref
- CVE-2018-5158 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant firefox (mozilla), pdfjs-dist.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 10.2%, plus élevée que 95.7% des vulnérabilités.
- Correctif : mettre à jour vers 52.8.0, 60.0, 2.0.550, 1.10.100 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| firefox | < 52.8.0< 60.0
| 52.8.060.0
|
| pdfjs-dist npm | ≥ 2.0.0, < 2.0.550< 1.10.100
| 2.0.5501.10.100
|
Description
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.
NVD description
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free