CVE-2018-12389

CWE-119 — Buffer OverflowCWE-120 — Classic Buffer Overflow8 documents8 sources
Severity
8.8HIGH
EPSS
1.8%
top 17.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Mozilla Firefox ESRMozilla ThunderbirdMozilla Firefox+8 more
Timeline
PublishedFeb 28
Latest updateMay 14

Description

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages9 packages

▶NVDmozilla/firefox< 60.3.0
▶CVEListV5mozilla/firefox_esrunspecified — 60.3
▶CVEListV5mozilla/thunderbirdunspecified — 60.3
▶NVDmozilla/thunderbird< 60.3.0
▶Debianfirefox-esr< 60.3.0esr-1+3

Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 16.04, 18.04, 18.10, Enterprise Linux 7.6, 7.5

🔴Vulnerability Details

3
GHSA
GHSA-fhjm-pw82-9596: Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60↗2022-05-14
▶
CVEList
CVE-2018-12389: Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60↗2019-02-28
▶
OSV
CVE-2018-12389: Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60↗2019-02-28
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2019-01-24
▶
Red Hat
Mozilla: Memory safety bugs fixed in Firefox ESR 60.3↗2018-10-23
▶
Debian
CVE-2018-12389: firefox-esr - Mozilla developers and community members reported memory safety bugs present in ...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-12389 Mozilla: Memory safety bugs fixed in Firefox ESR 60.3↗2018-10-23
▶
CVE-2018-12389 (HIGH CVSS 8.8) | Mozilla developers and community me | cvebase.io