| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | < 52.8.0< 60.0 | 52.8.060.0 |
| pdfjs-dist | ≥ 2.0.0, < 2.0.550< 1.10.100 | 2.0.5501.10.100 |
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8, Firefox < 60 and PDF.js < 2.0.550.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free