CVE-2018-5174

2018-06-1100:00:00

ubuntu.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.005 Low

EPSS

Percentile

77.5%

JSON

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors
the “SEE_MASK_FLAG_NO_UI” flag associated with downloaded files and will
not show any UI. Files that are unknown and potentially dangerous will be
allowed to run because SmartScreen will not prompt the user for a decision,
and if the user is offline all files will be allowed to be opened because
Windows won’t prompt the user to ask what to do. Firefox incorrectly sets
this flag when downloading files, leading to less secure behavior from
SmartScreen. Note: this issue only affects Windows 10 users running the
April 2018 update or later. It does not affect other Windows users or other
operating systems. This vulnerability affects Thunderbird < 52.8,
Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.