CVE-2018-18506
Medium
Description
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.
SeverityMedium
CVSS5.9
Exploit probability—
Product
Mozilla Firefox
PublishedFeb 5, 2019
First seenFeb 5, 2019
How to fix
Update
- mozilla firefox65.0 or later
Vendor advisories
- usn.ubuntu.com/3874-1/
- access.redhat.com/errata/RHSA-2019:0623
- access.redhat.com/errata/RHSA-2019:0622
- debian.org/security/2019/dsa-4411
- access.redhat.com/errata/RHSA-2019:0680
- access.redhat.com/errata/RHSA-2019:0681
- usn.ubuntu.com/3927-1/
- debian.org/security/2019/dsa-4420
- security.gentoo.org/glsa/201904-07
- access.redhat.com/errata/RHSA-2019:0966
- access.redhat.com/errata/RHSA-2019:1144
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | v < 65.0 | 65.0 |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10 | — |
| debian debian_linux | 8.0, 9.0 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 8.1, 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.6, 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server_eus | 7.6 | — |
| redhat enterprise_linux_server_tus | 7.6, 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| opensuse leap | 15.0, 42.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.