7.5

CVE-2018-12393

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox HwPlatform x86 Version < 63.0
Mozilla ≫ Firefox ESR HwPlatform x86 Version < 60.3
Mozilla ≫ Thunderbird HwPlatform x86 Version < 60.3
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Canonical ≫ Ubuntu Linux Version 18.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.92% 0.89
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html
Third Party Advisory
https://security.gentoo.org/glsa/201811-13
Third Party Advisory
https://usn.ubuntu.com/3868-1/
Third Party Advisory
http://www.securitytracker.com/id/1041944
Third Party Advisory
VDB Entry
https://usn.ubuntu.com/3801-1/
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-26/
Vendor Advisory
http://www.securityfocus.com/bid/105769
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3005
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3006
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3531
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3532
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html
Third Party Advisory
https://security.gentoo.org/glsa/201811-04
Third Party Advisory
https://www.debian.org/security/2018/dsa-4324
Third Party Advisory
https://www.debian.org/security/2018/dsa-4337
Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-27/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-28/
Vendor Advisory
http://www.securityfocus.com/bid/105718
Third Party Advisory
VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1495011
Vendor Advisory
Issue Tracking
Permissions Required