Vulnerability CVE-2018-12361: Information

Description

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

Severity: HIGH (8.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-12361
Published: Oct. 18, 2018
Modified: Dec. 6, 2018
Error type identifier: CWE-190

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus61.0-alt1125.0.2-alt1ALT-PU-2018-1985-1209471Fixed
firefoxp1061.0-alt1118.0.2-alt0.p10.1ALT-PU-2018-1985-1209471Fixed
firefoxp961.0-alt1105.0.1-alt0.c9.1ALT-PU-2018-1985-1209471Fixed
firefoxp861.0.1-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2018-2036-1209591Fixed
firefoxc10f161.0-alt1112.0.2-alt0.p10.1ALT-PU-2018-1985-1209471Fixed
firefoxc9f261.0-alt1105.0.1-alt0.c9.1ALT-PU-2018-1985-1209471Fixed
firefoxc760.6.1-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-1726-1218597Fixed
firefox-esrsisyphus60.1.0-alt1115.10.0-alt1ALT-PU-2018-1952-1209186Fixed
firefox-esrp1060.1.0-alt1115.10.0-alt1ALT-PU-2018-1952-1209186Fixed
firefox-esrp968.0.2-alt1102.11.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp860.1.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-1966-1207865Fixed
firefox-esrc10f160.1.0-alt1115.9.1-alt0.c10.1ALT-PU-2018-1952-1209186Fixed
firefox-esrc9f268.0.2-alt1102.12.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
thunderbirdsisyphus60.3.0-alt1115.9.0-alt1ALT-PU-2018-2669-1210777Fixed
thunderbirdp1060.3.0-alt1115.9.0-alt1ALT-PU-2018-2669-1210777Fixed
thunderbirdp960.3.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-2669-1210777Fixed
thunderbirdp860.7.2-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2019-2196-1216874Fixed
thunderbirdc10f160.3.0-alt1115.9.0-alt0.c10.1ALT-PU-2018-2669-1210777Fixed
thunderbirdc9f260.3.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-2669-1210777Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-19/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1463244
  • Issue Tracking
  • Permissions Required
DSA-4295
  • Third Party Advisory
USN-3705-1
  • Third Party Advisory
1041193
  • Third Party Advisory
  • VDB Entry
104558
  • Third Party Advisory
  • VDB Entry
GLSA-201810-01
  • Mitigation
  • Third Party Advisory
[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update
  • Third Party Advisory
GLSA-201811-13
  • Mitigation
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      61.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      60.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      60.1

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top