Vulnerability CVE-2018-5089: Information

Description

Memory safety bugs were reported in Firefox 57 and Firefox ESR 52.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-5089
Published: June 12, 2018
Modified: Aug. 3, 2018
Error type identifier: CWE-119

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus58.0.2-alt1126.0.1-alt1ALT-PU-2018-1178-1200448Fixed
firefoxp1058.0.2-alt1118.0.2-alt0.p10.1ALT-PU-2018-1178-1200448Fixed
firefoxp958.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2018-1178-1200448Fixed
firefoxp858.0.2-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2018-1221-1200523Fixed
firefoxc10f158.0.2-alt1112.0.2-alt0.p10.1ALT-PU-2018-1178-1200448Fixed
firefoxc9f258.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2018-1178-1200448Fixed
firefoxc760.6.1-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-1726-1218597Fixed
firefoxp1158.0.2-alt1126.0.1-alt1ALT-PU-2018-1178-1200448Fixed
firefox-esrsisyphus60.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed
firefox-esrp1060.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed
firefox-esrp960.0.1-alt1102.11.0-alt0.c9.1ALT-PU-2018-1854-1207816Fixed
firefox-esrp860.1.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-1966-1207865Fixed
firefox-esrc10f160.0.1-alt1115.9.1-alt0.c10.1ALT-PU-2018-1854-1207816Fixed
firefox-esrc9f260.0.1-alt1102.12.0-alt0.c9.1ALT-PU-2018-1854-1207816Fixed
firefox-esrp1160.0.1-alt1115.11.0-alt1ALT-PU-2018-1854-1207816Fixed
thunderbirdsisyphus52.6.0-alt1115.9.0-alt1ALT-PU-2018-1101-1198679Fixed
thunderbirdp1052.6.0-alt1115.9.0-alt1ALT-PU-2018-1101-1198679Fixed
thunderbirdp952.6.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1101-1198679Fixed
thunderbirdp852.6.0-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2018-1102-1198696Fixed
thunderbirdc10f152.6.0-alt1115.9.0-alt0.c10.1ALT-PU-2018-1101-1198679Fixed
thunderbirdc9f252.6.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1101-1198679Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed
thunderbirdp1152.6.0-alt1115.9.0-alt1ALT-PU-2018-1101-1198679Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-04/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-03/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-02/
  • Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1412420%2C1426783%2C1422389%2C1415598%2C1410134%2C1408017%2C1224396%2C1382366%2C1415582%2C1417797%2C1409951%2C1414452%2C1428589%2C1425780%2C1399520%2C1418854%2C1408276%2C1412145%2C1331209%2C1425612
  • Issue Tracking
DSA-4102
  • Third Party Advisory
DSA-4096
  • Third Party Advisory
USN-3544-1
  • Third Party Advisory
[debian-lts-announce] 20180129 [SECURITY] [DLA 1262-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20180124 [SECURITY] [DLA 1256-1] firefox-esr security update
  • Mailing List
  • Third Party Advisory
RHSA-2018:0262
  • Third Party Advisory
RHSA-2018:0122
  • Third Party Advisory
1040270
  • Third Party Advisory
  • VDB Entry
102783
  • Third Party Advisory
  • VDB Entry
USN-3688-1
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      52.6.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      52.6.0
      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End including
      58.0
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top