cbcvebase.
CVE-2018-12387
published 2018-10-18

CVE-2018-12387: A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes…

critical9.1CVSS 3.0
AVNACLPRNUINSUCHINAH
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.

Affected

23 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux——
canonicalubuntu_linux——
canonicalubuntu_linux——
debiandebian_linux——
debianfirefox< firefox 62.0.3-1 (sid)firefox 62.0.3-1 (sid)
debianfirefox-esr< firefox 62.0.3-1 (sid)firefox 62.0.3-1 (sid)
mozillafirefox< 60.2.260.2.2
mozillafirefox< 62.0.362.0.3
mozillafirefox>= 0 < 62.0.3+build1-0ubuntu0.14.04.262.0.3+build1-0ubuntu0.14.04.2
mozillafirefox>= 0 < 62.0.3+build1-0ubuntu0.16.04.262.0.3+build1-0ubuntu0.16.04.2
mozillafirefox>= 0 < 62.0.3+build1-0ubuntu0.18.04.162.0.3+build1-0ubuntu0.18.04.1
mozillafirefox>= unspecified < 62.0.362.0.3
mozillafirefox_esr>= unspecified < 60.2.260.2.2
redhatenterprise_linux_desktop——
redhatenterprise_linux_desktop——
redhatenterprise_linux_server——
redhatenterprise_linux_server——
redhatenterprise_linux_server_aus——
redhatenterprise_linux_server_eus——
redhatenterprise_linux_server_eus——
redhatenterprise_linux_server_tus——
redhatenterprise_linux_workstation——
redhatenterprise_linux_workstation——

CVSS provenance

nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
osv9.1CRITICAL