CVEvulnerability
CVE-2018-12361
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-10-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-190
Description
An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
Affected configurations
• mozilla firefox (< 61.0)
• mozilla firefox esr (< 60.1)
• mozilla thunderbird (< 60.0)
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 17.10
• canonical ubuntu linux 18.04
Related
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- http://www.securityfocus.com/bid/104558 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041193 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1463244 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Mitigation, Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Mitigation, Third Party Advisory
- https://usn.ubuntu.com/3705-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4295 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-15/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-19/ Vendor Advisory
- http://www.securityfocus.com/bid/104558 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041193 Third Party Advisory, VDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1463244 Issue Tracking, Permissions Required
- https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Mitigation, Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Mitigation, Third Party Advisory
- https://usn.ubuntu.com/3705-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4295 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-15/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-19/ Vendor Advisory