CVE-2018-12361 — Integer Overflow or Wraparound in Mozilla Firefox

CWE-190 — Integer Overflow or Wraparound10 documents7 sources
Severity
8.8HIGHNVD
OSV4.3
EPSS
1.2%
top 21.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+4 more
Timeline
PublishedOct 18
Latest updateMay 14

Description

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages10 packages

▶debiandebian/firefox< firefox 61.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 61
▶NVDmozilla/firefox< 61.0
▶CVEListV5mozilla/firefox_esrunspecified — 60.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 17.10, 18.04

🔴Vulnerability Details

4
GHSA
GHSA-67p3-5m2h-325j: An integer overflow can occur in the SwizzleData code while calculating buffer sizes↗2022-05-14
▶
OSV
CVE-2018-12361: An integer overflow can occur in the SwizzleData code while calculating buffer sizes↗2018-10-18
▶
OSV
firefox regressions↗2018-07-10
▶
OSV
firefox vulnerabilities↗2018-07-05
▶

📋Vendor Advisories

4
Ubuntu
Firefox regressions↗2018-07-10
▶
Ubuntu
Firefox vulnerabilities↗2018-07-05
▶
Red Hat
Mozilla: Integer overflow in SwizzleData↗2018-06-26
▶
Debian
CVE-2018-12361: firefox - An integer overflow can occur in the SwizzleData code while calculating buffer s...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-12361 Mozilla: Integer overflow in SwizzleData↗2018-06-26
▶
CVE-2018-12361 — Integer Overflow or Wraparound | cvebase