CVE-2018-5165
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected...
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
- Record
CVE-2018-5165- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
- Record
CVE-2018-5165- Updated
- 2026-11-02
EUVDEUVD-2018-16950 No score
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
- Record
EUVD-2018-16950- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hc8c-44hv-5hc7
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected...
In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash protected mode" is unchecked by default even though the Adobe Flash sandbox is actually enabled. The displayed state is the reverse of the true setting, resulting in user confusion. This could cause users to select this setting intending to activate it and inadvertently turn protections off. This vulnerability affects Firefox < 60.
- Record
GHSA-hc8c-44hv-5hc7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2872-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox to 68.2.0 ESR fixes the following issues:
Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).
Security issues fixed:
- CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
- CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
- CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
- CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
- CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
- CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).
- CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).
- CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).
- CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).
Non-security issues fixed:
- Firefox 60.7 ESR changed the user interface language (bsc#1137990).
- Wrong Firefox GUI Language (bsc#1120374).
- Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).
- Firefox hangs randomly when browsing and scrolling (bsc#1043008).
- Firefox stops loading page until mouse is moved (bsc#1025108).
- Record
SUSE-SU-2019:2872-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:HPE Helion OpenStack 8 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:OpenStack Cloud 7 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:OpenStack Cloud 8 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP1 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP1-LTSS From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxSUSE:Enterprise Storage 5 From an advisory covering 51 CVEs |
before 68.2.0-109.95.2 | 68.2.0-109.95.2 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-5165 is a medium vulnerability (CVSS 5.3) in Mozilla Firefox, published June 11, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. No source names a fixed version.
References
bugzilla.mozilla.org/show_bug.cgi?id=1451452
mozilla.org/security/advisories/mfsa2018-11
securitytracker.com/id/1040896
securityfocus.com/bid/104139
nvd.nist.gov/vuln/detail/CVE-2018-5165
github.com/advisories/GHSA-hc8c-44hv-5hc7
Show 194 moreShow less
suse.com/support/update/announcement/2019/suse-su-20192872-1
bugzilla.suse.com/1010399
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
Left out here: 1,693 references. The JSON record has them.