PT-2018-1890 · Mozilla+6 · Firefox Esr+8
Richard Zhu
·
Publicado
2018-03-16
·
Atualizado
2024-12-12
·
CVE-2018-5146
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libvorbis (affected versions not specified)
Firefox versions prior to 59.0.1
Firefox ESR versions prior to 52.7.2
Thunderbird versions prior to 52.7
Description
The issue is related to an error in the libvorbis multimedia library, causing a read beyond the allocated buffer memory. This can be exploited by a remote attacker using specially crafted Vorbis audio data to cause a denial of service or compromise data confidentiality and integrity. The vulnerability was reported through the Pwn2Own contest and is associated with an out of bounds memory write while processing Vorbis audio data.
Recommendations
For libvorbis, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For Firefox versions prior to 59.0.1, update to version 59.0.1 or later.
For Firefox ESR versions prior to 52.7.2, update to version 52.7.2 or later.
For Thunderbird versions prior to 52.7, update to version 52.7 or later.
Exploit
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Firefox
Firefox Esr
Red Hat
Suse
Thunderbird
Ubuntu
Libvorbis