Skip to content
OpenAdvisories
Unscored CVE-2018-12391 EUVD-2018-4365GHSA-77j4-f249-58h4

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Becau…

Published Feb 28, 2019 · Updated Aug 5, 2024 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Firefox ESR Product: Thunderbird Category: Browsers

Description

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 63 63
Mozilla Firefox ESR unspecified – < 60.3 60.3
Mozilla Thunderbird unspecified – < 60.3 60.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 MozillaThunderbird 60.3.0-3.17.2 SUSE-SU-2018:3769-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 MozillaThunderbird 60.3.0-74.2 openSUSE-SU-2018:3687-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 92.0-1.2 openSUSE-SU-2024:10600-1
openSUSE Tumbleweed MozillaThunderbird 91.1.1-1.1 openSUSE-SU-2024:10601-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 5

References