CVE-2018-12376 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-120 — Classic Buffer Overflow14 documents8 sources
Severity
9.8CRITICALNVD
OSV8.8
EPSS
3.1%
top 13.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+8 more
Timeline
PublishedOct 18
Latest updateMay 14

Description

Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages11 packages

▶CVEListV5mozilla/firefoxunspecified — 62
▶NVDmozilla/firefox< 60.2.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 60.2
▶Ubuntumozilla/firefox< 62.0+build2-0ubuntu0.14.04.3+2
▶CVEListV5mozilla/thunderbirdunspecified — 60.2.1

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, Enterprise Linux 7.6, 7.5

🔴Vulnerability Details

7
GHSA
GHSA-qv7h-qvhv-jxmh: Memory safety bugs present in Firefox 61 and Firefox ESR 60↗2022-05-14
▶
OSV
CVE-2018-12376: Memory safety bugs present in Firefox 61 and Firefox ESR 60↗2018-10-18
▶
CVEList
CVE-2018-12376: Memory safety bugs present in Firefox 61 and Firefox ESR 60↗2018-10-18
▶
OSV
thunderbird vulnerabilities↗2018-10-15
▶
OSV
firefox regressions↗2018-09-17
▶

📋Vendor Advisories

4
Ubuntu
Thunderbird vulnerabilities↗2018-10-15
▶
Ubuntu
Firefox vulnerabilities↗2018-09-06
▶
Red Hat
Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2↗2018-09-05
▶
Debian
CVE-2018-12376: firefox - Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bug...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-12376 Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2↗2018-09-05
▶
Bugzilla
CVE-2017-12374 CVE-2017-12375 CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380 clamav: Multiple vulnerabilities fixed in 0.99.3↗2018-01-29
▶
CVE-2018-12376 — Mozilla Firefox vulnerability | cvebase