CVE-2018-12368: High severity Mozilla Thunderbird vulnerability
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems Note: this issue only affects Windows operating systems. Other operating systems are unaffected.
Other sources
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.9 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 61 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.1 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 60
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-12368?
CVE-2018-12368 has been identified as a moderate severity vulnerability that may allow execution of unwanted files without user consent.
How do I fix CVE-2018-12368?
To fix CVE-2018-12368, ensure that you are using the latest versions of Mozilla Thunderbird or Firefox as updates have addressed this vulnerability.
Which software versions are affected by CVE-2018-12368?
CVE-2018-12368 affects Mozilla Firefox versions prior to 61.0 and Thunderbird versions prior to 60.
What are SettingContent-ms files related to CVE-2018-12368?
SettingContent-ms files are special file types in Windows that may execute potentially harmful actions if opened without user warnings.
How does CVE-2018-12368 impact Windows 10 users?
CVE-2018-12368 impacts Windows 10 users by allowing them to open executable files without receiving a warning, increasing the risk of executing malicious content.