CVE-2018-5158
Publication date 10 May 2018
Last updated 25 August 2025
Ubuntu priority
Description
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 60.0+build2-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 60.0+build2-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 60.0+build2-0ubuntu0.14.04.1
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.8 · High
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-3645-1
- Firefox vulnerabilities
- 11 May 2018