CVE-2018-5165

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51667.5WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic an CVE-2018-51674.3The web console and JavaScript debugger do not sanitize all output that can be hyperlinked. Both will display "chrome:" links as active, cli CVE-2018-51685.3Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. T CVE-2018-51696.5If manipulated hyperlinked text with "chrome:" URL contained in it is dragged and dropped on the "home" icon, the home page can be reset to CVE-2018-51704.3It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote a CVE-2018-51724.3The Live Bookmarks page and the PDF viewer can run injected script content if a user pastes script from the clipboard into them while viewin CVE-2018-51735.3The filename appearing in the "Downloads" panel improperly renders some Unicode characters, allowing for the file name to be spoofed. This c CVE-2018-51747.5In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and CVE-2018-51756.1A mechanism to bypass Content Security Policy (CSP) protections on sites that have a "script-src" policy of "'strict-dynamic'". If a target CVE-2018-51766.1The JSON Viewer displays clickable hyperlinks for strings that are parseable as URLs, including "javascript:" links. If a JSON file contains CVE-2018-51777.5A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer CVE-2018-51788.1A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerabil