7

CVE-2018-12385

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Mozilla ≫ Firefox Version < 62.0.2
Mozilla ≫ Firefox ESR Version < 60.2.1
Mozilla ≫ Thunderbird Version < 60.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.275
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://access.redhat.com/errata/RHSA-2018:3403
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3458
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html
Third Party Advisory
Mailing List
https://security.gentoo.org/glsa/201810-01
Third Party Advisory
https://security.gentoo.org/glsa/201811-13
Third Party Advisory
https://www.debian.org/security/2018/dsa-4327
Third Party Advisory
https://usn.ubuntu.com/3793-1/
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-25/
Vendor Advisory
http://www.securitytracker.com/id/1041701
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2834
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2835
Third Party Advisory
https://www.debian.org/security/2018/dsa-4304
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-23/
Vendor Advisory
http://www.securityfocus.com/bid/105380
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041700
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1490585
Vendor Advisory
Issue Tracking
Permissions Required
https://usn.ubuntu.com/3778-1/
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-22/
Vendor Advisory