CVE-2018-5145 Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code...
CriticalCVSS 9.8
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 52.7.0esr-1 | 52.7.0esr-1 |
| debian/firefox-esr(Debian:13) | < 52.7.0esr-1 | 52.7.0esr-1 |
| debian/firefox-esr(Debian:14) | < 52.7.0esr-1 | 52.7.0esr-1 |
| debian/thunderbird(Debian:12) | < 1:52.7.0-1 | 1:52.7.0-1 |
| debian/thunderbird(Debian:13) | < 1:52.7.0-1 | 1:52.7.0-1 |
| debian/thunderbird(Debian:14) | < 1:52.7.0-1 | 1:52.7.0-1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| mozilla Firefox | < 52.7.0 | 52.7.0 |
| mozilla Thunderbird | < 52.7.0 | 52.7.0 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| mozilla firefox esr | < 52.7 | 52.7 |
| mozilla Thunderbird | < 52.7 | 52.7 |
References
- Debian Security Tracker CVE-2018-5145 vendor-advisory
- 103384 third-party-advisory vdb-entry
- 1040514 third-party-advisory vdb-entry
- RHSA-2018:0526 third-party-advisory vendor-advisory
- RHSA-2018:0527 third-party-advisory vendor-advisory
- RHSA-2018:0647 third-party-advisory vendor-advisory
- RHSA-2018:0648 third-party-advisory vendor-advisory
- bugzilla.mozilla.org issue-tracking permissions-required third-party-advisory
- [debian-lts-announce] 20180315 [SECURITY] [DLA 1308-1] firefox-esr security update mailing-list third-party-advisory
- [debian-lts-announce] 20180329 [SECURITY] [DLA 1327-1] thunderbird security update mailing-list third-party-advisory
- GLSA-201811-13 third-party-advisory vendor-advisory
- USN-3545-1 third-party-advisory vendor-advisory
- DSA-4139 third-party-advisory vendor-advisory
- DSA-4155 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory