Vulnerability CVE-2018-5145: Information

Description

Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.

Severity: CRITICAL (9.8) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-5145
Published: June 12, 2018
Modified: March 13, 2019
Error type identifier: CWE-119

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus53.0.2-alt1125.0.2-alt1ALT-PU-2017-1577-1182567Fixed
firefoxp1053.0.2-alt1118.0.2-alt0.p10.1ALT-PU-2017-1577-1182567Fixed
firefoxp953.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2017-1577-1182567Fixed
firefoxp853.0.2-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2017-1579-1182593Fixed
firefoxc10f153.0.2-alt1112.0.2-alt0.p10.1ALT-PU-2017-1577-1182567Fixed
firefoxc9f253.0.2-alt1105.0.1-alt0.c9.1ALT-PU-2017-1577-1182567Fixed
firefoxc752.7.3-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2018-1583-1203884Fixed
firefox-esrsisyphus52.7.0-alt1115.10.0-alt1ALT-PU-2018-1402-1201647Fixed
firefox-esrp1052.7.0-alt1115.10.0-alt1ALT-PU-2018-1402-1201647Fixed
firefox-esrp952.7.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1402-1201647Fixed
firefox-esrp852.7.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-1403-1201658Fixed
firefox-esrc10f152.7.0-alt1115.9.1-alt0.c10.1ALT-PU-2018-1402-1201647Fixed
firefox-esrc9f252.7.0-alt1102.12.0-alt0.c9.1ALT-PU-2018-1402-1201647Fixed
thunderbirdsisyphus52.7.0-alt1115.9.0-alt1ALT-PU-2018-1481-1202882Fixed
thunderbirdp1052.7.0-alt1115.9.0-alt1ALT-PU-2018-1481-1202882Fixed
thunderbirdp952.7.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1481-1202882Fixed
thunderbirdp852.7.0-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2018-1483-1202900Fixed
thunderbirdc10f152.7.0-alt1115.9.0-alt0.c10.1ALT-PU-2018-1481-1202882Fixed
thunderbirdc9f252.7.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1481-1202882Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-09/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-07/
  • Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1261175%2C1348955
  • Issue Tracking
  • Permissions Required
  • Third Party Advisory
DSA-4155
  • Third Party Advisory
DSA-4139
  • Third Party Advisory
USN-3545-1
  • Third Party Advisory
[debian-lts-announce] 20180329 [SECURITY] [DLA 1327-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20180315 [SECURITY] [DLA 1308-1] firefox-esr security update
  • Mailing List
  • Third Party Advisory
RHSA-2018:0648
  • Third Party Advisory
RHSA-2018:0647
  • Third Party Advisory
RHSA-2018:0527
  • Third Party Advisory
RHSA-2018:0526
  • Third Party Advisory
1040514
  • Third Party Advisory
  • VDB Entry
103384
  • Third Party Advisory
  • VDB Entry
GLSA-201811-13
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      52.7.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      52.7.0

      Configuration 4

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top