CVE-2018-18506

CVE Details

Release Date:

2019-02-05

Description

When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server. This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow for attacks on services and tools that bind to the localhost for networked behavior if they are accessed through browsing. This vulnerability affects Firefox < 65.

See more information about CVE-2018-18506 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	5.9	Base Metrics:	AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Access Vector:	Network	Attack Complexity:	High
Privileges Required:	None	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	High	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (firefox)	ELSA-2019-0623	2019-03-20
Oracle Linux version 6 (thunderbird)	ELSA-2019-0680	2019-03-28
Oracle Linux version 7 (firefox)	ELSA-2019-0622	2019-03-20
Oracle Linux version 7 (thunderbird)	ELSA-2019-0681	2019-03-28
Oracle Linux version 8 (firefox)	ELSA-2019-0966	2019-07-30
Oracle Linux version 8 (thunderbird)	ELSA-2019-1144	2019-07-30

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team