CVEvulnerability
CVE-2018-12385
7.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-10-18
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.0 HIGH — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.
Affected configurations
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server eus 7.5
• redhat enterprise linux server eus 7.6
• redhat enterprise linux server tus 7.6
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• debian debian linux 8.0
• debian debian linux 9.0
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• mozilla firefox (< 62.0.2)
• mozilla firefox esr (< 60.2.1)
• mozilla thunderbird (< 60.2.1)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.securityfocus.com/bid/105380 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041700 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041701 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2834 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2835 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3403 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3458 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1490585 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Third Party Advisory
- https://usn.ubuntu.com/3778-1/ Third Party Advisory
- https://usn.ubuntu.com/3793-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4304 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4327 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-22/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-23/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-25/ Vendor Advisory
- http://www.securityfocus.com/bid/105380 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041700 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041701 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2834 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2835 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3403 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3458 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1490585 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/201810-01 Third Party Advisory
- https://security.gentoo.org/glsa/201811-13 Third Party Advisory
- https://usn.ubuntu.com/3778-1/ Third Party Advisory
- https://usn.ubuntu.com/3793-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4304 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4327 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-22/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-23/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-25/ Vendor Advisory