CVE-2018-5147 The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefo...
CriticalCVSS 9.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 52.7.2esr-1 | 52.7.2esr-1 |
| debian/firefox-esr(Debian:13) | < 52.7.2esr-1 | 52.7.2esr-1 |
| debian/firefox-esr(Debian:14) | < 52.7.2esr-1 | 52.7.2esr-1 |
| debian/libvorbisidec(Debian:12) | < 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
| debian/libvorbisidec(Debian:13) | < 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
| debian/libvorbisidec(Debian:14) | < 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| mozilla Firefox | < 52.7.2 | 52.7.2 |
| mozilla Firefox | < 59.0.1 | 59.0.1 |
| mozilla firefox esr | < 52.7.2 | 52.7.2 |
References
- Debian Security Tracker CVE-2018-5147 vendor-advisory
- 103432 third-party-advisory vdb-entry
- 1040544 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking permissions-required
- [debian-lts-announce] 20180322 [SECURITY] [DLA 1312-1] libvorbisidec security update mailing-list third-party-advisory
- [debian-lts-announce] 20180326 [SECURITY] [DLA 1319-1] firefox-esr security update mailing-list third-party-advisory
- DSA-4141 third-party-advisory vendor-advisory
- DSA-4143 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- bugs.debian.org issue-tracking