Memory corruption in Mozilla Firefox - CVE-2018-5187
Published: June 27, 2018
Vulnerability identifier: #VU13494
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-5187
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when handling malicious input. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Mozilla Firefox
Firefox ESR
Arch Linux
Debian Linux
Gentoo Linux
Opensuse
openSUSE Leap
Mozilla Thunderbird
Firefox ESR
Arch Linux
Debian Linux
Gentoo Linux
Opensuse
openSUSE Leap
Mozilla Thunderbird
How to mitigate CVE-2018-5187
Update to version 61.0.
Mozilla Firefox - update to 61.0
Mozilla Thunderbird - update to 60.0
Mozilla Thunderbird - update to 60.0
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in Mozilla Firefox ESR
- Arch Linux update for firefox
- OpenSUSE Linux update for MozillaFirefox
- Multiple vulnerabilities in Mozilla Thunderbird
- Arch Linux update for thunderbird
- OpenSUSE Linux update for MozillaThunderbird
- Debian update for thunderbird
- Gentoo update for Mozilla Firefox
- OpenSUSE Linux update for MozillaThunderbird
- Gentoo update for Mozilla Thunderbird
- OpenSUSE Linux update for MozillaThunderbird