CVE-2018-5158 — Vulnetix

Try Vulnetix Request Demo

CVE-2018-5158 PUBLISHED

The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.

EPSS 41.38% · 97.4th percentile

Risk Scores

EPSS Score

41.38%

97.4th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:18.04:LTS	firefox	0, 56.0+build6-0ubuntu1, 57.0.1+build2-0ubuntu1
Ubuntu:16.04:LTS	firefox	44.0.2+build1-0ubuntu1, 45.0+build2-0ubuntu1, 45.0.1+build1-0ubuntu1
Ubuntu:14.04:LTS	firefox	50.1.0+build2-0ubuntu0.14.04.1, 51.0.1+build2-0ubuntu0.14.04.1, 51.0.1+build2-0ubuntu0.14.04.2

Timeline

CVE Published
May 23, 2020 PoC Published
Apr 14, 2021 EPSS Score
Feb 4, 2022 EPSS Score
Nov 2, 2023 EPSS Score
Dec 12, 2023 EPSS Score
Mar 17, 2025 EPSS Score
Mar 20, 2025 EPSS Score
Mar 24, 2025 EPSS Score
Mar 28, 2025 EPSS Score
Mar 30, 2025 EPSS Score
Apr 22, 2025 EPSS Score

References

https://ubuntu.com/security/CVE-2018-5158 third-party-advisory
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/#CVE-2018-5158 third-party-advisory
https://ubuntu.com/security/notices/USN-3645-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2018-5158 third-party-advisory

Open in Interactive Console →