CVE-2018-12371
published 2020-07-09CVE-2018-12371: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the…
PriorityP337high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.45%
70.1th percentile
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 61.0-1 (sid) | firefox 61.0-1 (sid) |
| debian | thunderbird | < firefox 61.0-1 (sid) | firefox 61.0-1 (sid) |
| mozilla | firefox | < 60.1.0 | 60.1.0 |
| mozilla | firefox | < 61.0 | 61.0 |
| mozilla | firefox | >= 0 < 61.0.1+build1-0ubuntu0.14.04.1 | 61.0.1+build1-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 61.0+build3-0ubuntu0.14.04.2 | 61.0+build3-0ubuntu0.14.04.2 |
| mozilla | firefox | >= 0 < 61.0.1+build1-0ubuntu0.16.04.1 | 61.0.1+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 61.0+build3-0ubuntu0.16.04.2 | 61.0+build3-0ubuntu0.16.04.2 |
| mozilla | firefox | >= 0 < 61.0.1+build1-0ubuntu0.18.04.1 | 61.0.1+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 61.0+build3-0ubuntu0.18.04.1 | 61.0+build3-0ubuntu0.18.04.1 |
| mozilla | firefox | >= unspecified < 61 | 61 |
| mozilla | firefox_esr | >= unspecified < 60.1 | 60.1 |
| mozilla | thunderbird | < 60.0 | 60.0 |
| mozilla | thunderbird | >= 0 < 1:60.0-1 | 1:60.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.0-1 | 1:60.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.0-1 | 1:60.0-1 |
| mozilla | thunderbird | >= 0 < 1:60.0-1 | 1:60.0-1 |
| mozilla | thunderbird | >= unspecified < 60 | 60 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jvm4-fpvm-vr72: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM
ghsa_unreviewed·2022-05-24
CVE-2018-12371 [MEDIUM] CWE-190 GHSA-jvm4-fpvm-vr72: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
OSV
CVE-2018-12371: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM
osv·2020-07-09·CVSS 8.8
CVE-2018-12371 [HIGH] CVE-2018-12371: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
OSV
firefox regressions
osv·2018-07-10·CVSS 4.3
[MEDIUM] firefox regressions
firefox regressions
USN-3705-1 fixed vulnerabilities in Firefox. The update introduced various
minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, bypass same-origin restrictions, bypass CORS restrictions,
bypass CSRF protections, obtain sensitive information, or execute
arbitrary code. (CVE-2018-5156, CVE-2018-5186, CVE-2018-5187,
CVE-2018-5188, CVE-2018-12358, CVE-2018-12359, CVE-2018-12360,
CVE-2018-12361, CVE-2018-12362, CVE-2018-12363, CVE-2018-12364,
CVE-2018-12365, CVE-2018-12366, CVE-2018-12367, CVE-2
OSV
firefox vulnerabilities
osv·2018-07-05·CVSS 4.3
CVE-2018-5156 [MEDIUM] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, bypass same-origin restrictions, bypass CORS restrictions,
bypass CSRF protections, obtain sensitive information, or execute
arbitrary code. (CVE-2018-5156, CVE-2018-5186, CVE-2018-5187,
CVE-2018-5188, CVE-2018-12358, CVE-2018-12359, CVE-2018-12360,
CVE-2018-12361, CVE-2018-12362, CVE-2018-12363, CVE-2018-12364,
CVE-2018-12365, CVE-2018-12366, CVE-2018-12367, CVE-2018-12370,
CVE-2018-12371)
A security issue was discovered with WebExtensions. If a user were
tricked in to installing a specially crafted extension, an attacker
could potentially exploit
Ubuntu
Firefox regressions
vendor_ubuntu·2018-07-10·CVSS 4.3
[MEDIUM] Firefox regressions
Title: Firefox regressions
Summary: USN-3705-1 caused some minor regressions in Firefox.
USN-3705-1 fixed vulnerabilities in Firefox. The update introduced various
minor regressions. This update fixes the problems.
We apologize for the inconvenience.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, bypass same-origin restrictions, bypass CORS restrictions,
bypass CSRF protections, obtain sensitive information, or execute
arbitrary code. (CVE-2018-5156, CVE-2018-5186, CVE-2018-5187,
CVE-2018-5188, CVE-2018-12358, CVE-2018-12359, CVE-2018-12360,
CVE-2018-12361, CVE-2018-12362, CVE-2018-12363,
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2018-07-05·CVSS 4.3
CVE-2018-5156 [MEDIUM] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, bypass same-origin restrictions, bypass CORS restrictions,
bypass CSRF protections, obtain sensitive information, or execute
arbitrary code. (CVE-2018-5156, CVE-2018-5186, CVE-2018-5187,
CVE-2018-5188, CVE-2018-12358, CVE-2018-12359, CVE-2018-12360,
CVE-2018-12361, CVE-2018-12362, CVE-2018-12363, CVE-2018-12364,
CVE-2018-12365, CVE-2018-12366, CVE-2018-12367, CVE-2018-12370,
CVE-2018-12371)
A security issue was discovered with WebExtensio
Red Hat
Mozilla: Integer overflow in Skia library during edge builder allocation
vendor_redhat·2018-06-26·CVSS 8.8
CVE-2018-12371 [HIGH] CWE-190 Mozilla: Integer overflow in Skia library during edge builder allocation
Mozilla: Integer overflow in Skia library during edge builder allocation
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2018-12371: firefox - An integer overflow vulnerability in the Skia library when allocating memory for...
vendor_debian·2018·CVSS 8.8
CVE-2018-12371 [HIGH] CVE-2018-12371: firefox - An integer overflow vulnerability in the Skia library when allocating memory for...
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
Scope: local
sid: resolved (fixed in 61.0-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-12371 Mozilla: Integer overflow in Skia library during edge builder allocation
bugzilla·2018-06-26·CVSS 8.8
CVE-2018-12371 [HIGH] CVE-2018-12371 Mozilla: Integer overflow in Skia library during edge builder allocation
CVE-2018-12371 Mozilla: Integer overflow in Skia library during edge builder allocation
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12371
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: anonymous
Bugzilla
Heap overflow write in SkEdgeBuilder::buildPoly
bugzilla·2018-05-31
[MEDIUM] Heap overflow write in SkEdgeBuilder::buildPoly
Heap overflow write in SkEdgeBuilder::buildPoly
Created attachment 8982105
poc16G.html
User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Build ID: 20180517113820
Steps to reproduce:
This is a variant of vulnerability hrer:https://bugzilla.mozilla.org/show_bug.cgi?id=1418447
System: Ubuntu 16.04.4 LTS (64bit)
Firefox version: 60.0.1 (64-bit)
RAM size:16G
SWAP size:5.9G
Root cause:
https://searchfox.org/mozilla-central/source/gfx/skia/skia/src/core/SkEdgeBuilder.cpp#255
SkPath::Iter iter(path, true);
SkPoint pts[4];
SkPath::Verb verb;
size_t maxEdgeCount = path.countPoints();
if (iclip) {
// clipping can turn 1 line into (up to) kMaxClippedLineSegments, since
// we turn portions that are clipped out on the left/right into vertical
// segments.
https://bugzilla.mozilla.org/show_bug.cgi?id=1465686https://www.mozilla.org/security/advisories/mfsa2018-15/https://www.mozilla.org/security/advisories/mfsa2018-16/https://www.mozilla.org/security/advisories/mfsa2018-19/https://bugzilla.mozilla.org/show_bug.cgi?id=1465686https://www.mozilla.org/security/advisories/mfsa2018-15/https://www.mozilla.org/security/advisories/mfsa2018-16/https://www.mozilla.org/security/advisories/mfsa2018-19/
2020-07-09
Published