Integer overflow in Mozilla Firefox - CVE-2018-12371
Published: June 27, 2018 / Updated: July 15, 2020
Vulnerability identifier: #VU13484
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12371
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Mozilla Firefox
Firefox ESR
Arch Linux
Debian Linux
Gentoo Linux
Opensuse
openSUSE Leap
Mozilla Thunderbird
Firefox ESR
Arch Linux
Debian Linux
Gentoo Linux
Opensuse
openSUSE Leap
Mozilla Thunderbird
How to mitigate CVE-2018-12371
Update to version 61.0.
Mozilla Firefox - update to 61.0
Mozilla Thunderbird - update to 60.0
Mozilla Thunderbird - update to 60.0
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in Mozilla Firefox ESR
- Arch Linux update for firefox
- OpenSUSE Linux update for MozillaFirefox
- Multiple vulnerabilities in Mozilla Thunderbird
- Arch Linux update for thunderbird
- OpenSUSE Linux update for MozillaThunderbird
- Debian update for thunderbird
- Gentoo update for Mozilla Firefox
- OpenSUSE Linux update for MozillaThunderbird
- Gentoo update for Mozilla Thunderbird
- OpenSUSE Linux update for MozillaThunderbird