CVE-2018-12368

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. *Note: this issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

• http://www.securityfocus.com/bid/104560Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1468217Issue Tracking, Permissions Required, Vendor Advisory
• https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/201810-01Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-17/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-18/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory
• http://www.securityfocus.com/bid/104560Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1468217Issue Tracking, Permissions Required, Vendor Advisory
• https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/201810-01Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-17/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-18/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory

Published

Oct 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12362An integer overflow can occur during graphics operations don…
• CVE-2018-12363A use-after-free vulnerability can occur when script uses mu…
• CVE-2018-12364NPAPI plugins, such as Adobe Flash, can send non-simple cros…
• CVE-2018-12365A compromised IPC child process can escape the content sandb…
• CVE-2018-12366An invalid grid size during QCMS (color profile) transformat…
• CVE-2018-12367In the previous mitigations for Spectre, the resolution or p…
• CVE-2018-12369WebExtensions bundled with embedded experiments were not cor…
• CVE-2018-1237Dell EMC ScaleIO versions prior to 2.5, contain improper res…
• CVE-2018-12370In Reader View SameSite cookie protections are not checked o…
• CVE-2018-12371An integer overflow vulnerability in the Skia library when a…8.8
• CVE-2018-12372Decrypted S/MIME parts, when included in HTML crafted for an…
• CVE-2018-12373dDecrypted S/MIME parts hidden with CSS or the plaintext HTM…