Out-of-bounds read in Mozilla Firefox - CVE-2018-5153
Published: May 10, 2018
Vulnerability identifier: #VU12541
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5153
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to out-of-bounds read in mixed content websocket messages. A remote attacker can send websocket data with mixed text and binary in a single message, corrupt binary data, trigger an out-of-bounds read with the read memory sent to the originating server in response.
The weakness exists due to out-of-bounds read in mixed content websocket messages. A remote attacker can send websocket data with mixed text and binary in a single message, corrupt binary data, trigger an out-of-bounds read with the read memory sent to the originating server in response.
Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Ubuntu package)
Arch Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2018-5153
Update to version 60.0.
firefox (Ubuntu package) - addressed in versions 60.0+build2-0ubuntu0.14.04.1, 60.0+build2-0ubuntu0.16.04.1, 60.0+build2-0ubuntu0.17.10.1, 60.0+build2-0ubuntu1