CVE-2018-12386 — Incorrect Type Conversion or Cast in Mozilla Firefox
Severity
8.1HIGHNVD
EPSS
39.1%
top 2.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 18
Latest updateMay 14
Description
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2
Affected Packages6 packages
Also affects: Debian Linux 9.0, Ubuntu Linux 14.04, 16.04, 18.04, Enterprise Linux 7.6, 7.5
Patches
🔴Vulnerability Details
4GHSA▶
GHSA-5vgc-hmw3-287j: A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write↗2022-05-14
OSV▶
CVE-2018-12386: A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write↗2018-10-18
CVEList▶
CVE-2018-12386: A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write↗2018-10-18