8.1

CVE-2018-12386

Exploit
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version9.0
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Mozilla ≫ Firefox Version < 60.2.2
Mozilla ≫ Firefox Version < 62.0.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 13.42% 0.959
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-704 Incorrect Type Conversion or Cast

The product does not correctly convert an object, resource, or structure from one type to a different type.

https://security.gentoo.org/glsa/201810-01
Third Party Advisory
https://usn.ubuntu.com/3778-1/
Third Party Advisory
http://www.securityfocus.com/bid/105460
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041770
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:2881
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2884
Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1493900
Patch
Vendor Advisory
Exploit
Issue Tracking
https://www.debian.org/security/2018/dsa-4310
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-24/
Vendor Advisory