PT-2018-3015 · Mozilla+5 · Firefox+5

Bruno Keith

+2

·

Publicado

2018-10-02

·

Atualizado

2024-12-12

·

CVE-2018-12386

CVSS v2.0

9.4

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 62.0.3 Firefox ESR versions prior to 60.2.2
Description A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. The issue is related to errors in data type conversion.
Recommendations For Firefox versions prior to 62.0.3, update to version 62.0.3 or later to resolve the issue. For Firefox ESR versions prior to 60.2.2, update to version 60.2.2 or later to resolve the issue.

Exploit

Correção

RCE

Incorrect Type Conversion or Cast

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-704

Identificadores relacionados

ALT-PU-2018-2417
ALT-PU-2018-2423
ALT-PU-2019-2324
ALT-PU-2019-2486
BDU:2019-03414
CESA-2018_2881
CESA-2018_2884
CVE-2018-12386
DSA-4310-1
MGASA-2018-0396
OPENSUSE-SU-2018_2996-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
RHSA-2018:2881
RHSA-2018:2884
RHSA-2018_2881
RHSA-2018_2884
SUSE-SU-2018:3476-1
SUSE-SU-2018:3591-1
SUSE-SU-2018:3591-2
USN-3778-1

Produtos afetados

Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu