6.5

CVE-2018-12366

An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Data is provided by the National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Mozilla ≫ Firefox Version < 61.0
Mozilla ≫ Firefox Version >= 53.0 < 60.1.0
Mozilla ≫ Firefox ESR Version < 52.9
Mozilla ≫ Thunderbird Version < 52.9
Mozilla ≫ Thunderbird Version >= 52.9.1 < 60.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.4% 0.602
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-125 Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

http://www.securitytracker.com/id/1041193
Third Party Advisory
VDB Entry
https://usn.ubuntu.com/3705-1/
Third Party Advisory
https://usn.ubuntu.com/3714-1/
Third Party Advisory
http://www.securityfocus.com/bid/104560
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1464039
Vendor Advisory
Issue Tracking
Permissions Required