Read the docs
TI-2018-03737 Aliases CVE-2018-5174GHSA-cx2r-fxw7-w76f

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the…

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any UI. Files that are unknown and potentially dangerous will be allowed to run because SmartScreen will not prompt the user for a decision, and if the user is offline all files will be allowed to be opened because Windows won't prompt the user to ask what to do. Firefox incorrectly sets this flag when downloading files, leading to less secure behavior from SmartScreen. Note: this issue only affects Windows 10 users running the April 2018 update or later. It does not affect other Windows users or other operating systems. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Why it matters now

EPSS 0.01809 78th percentileScored 2026-11-07
Fix Fixed Thunderbird (Mozilla): 52.8Thunderbird ESR (Mozilla): 52.8+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaThunderbirdbefore 52.852.8Patch availableCNA
MozillaThunderbird ESRbefore 52.852.8Patch availableCNA
MozillaFirefoxbefore 6060Patch availableCNA
MozillaFirefox ESRbefore 52.852.8Patch availableCNA
  • Thunderbird VendorMozilla Affected before 52.8 Fixed in 52.8 Patch available CNA
  • Thunderbird ESR VendorMozilla Affected before 52.8 Fixed in 52.8 Patch available CNA
  • Firefox VendorMozilla Affected before 60 Fixed in 60 Patch available CNA
  • Firefox ESR VendorMozilla Affected before 52.8 Fixed in 52.8 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*before 52.8.0; before 60.0VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*before 52.8.0VulnerableMozilla
cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*before 52.8.0VulnerableMozilla
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 52.8.0; before 60.0 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* Versions before 52.8.0 Vulnerable ·Mozilla
  • cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* Versions before 52.8.0 Vulnerable ·Mozilla
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Thunderbird (Mozilla) Fixed in 52.8
  • Fix · CNA Thunderbird ESR (Mozilla) Fixed in 52.8
  • Fix · CNA Firefox (Mozilla) Fixed in 60
  • Fix · CNA Firefox ESR (Mozilla) Fixed in 52.8

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mozilla Firefox 60

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-03729 In 32-bit versions of Firefox, the Adobe Flash plugin setting for "Enable Adobe Flash…Priority LOW 27
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-5174
  2. 2026-10-03 Alias added: GHSA-cx2r-fxw7-w76f

References

Advisory 4

  • TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3444 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences