PT-2018-2994 · Mozilla+3 · Firefox+3

Andreas Perhson · Published 2018-05-09 · Updated 2024-12-12 · CVE-2018-5160

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60 Firefox versions prior to 60

Description The issue is related to the WrappedI420Buffer function in the WebRTC component of the Firefox browser, which can lead to a buffer overflow in memory. This can cause a potentially exploitable crash when the WebRTC encoder uses uninitialized memory.

Recommendations For Firefox ESR versions prior to 60, update to version 60 or later to resolve the issue. For Firefox versions prior to 60, update to version 60 or later to resolve the issue.

Fix

Use of Uninitialized Resource

Use After Free

Buffer Overflow

Weakness Enumeration

CWE-908

CWE-416

CWE-119

Related Identifiers

ALT-PU-2018-1787

ALT-PU-2018-1854

BDU:2019-03313

CVE-2018-5160

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:2872-1

USN-3645-1

USN-3645-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 1932

• https://bdu.fstec.ru/vul/2019-03313 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-11 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-5160 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2872-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5157 · Vendor Advisory
• https://usn.ubuntu.com/3645-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5160 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5154 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3645-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5159 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1436117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5177 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5158 · Vendor Advisory