PT-2018-3016 · Mozilla+5 · Firefox+5

Bruno Keith + 1 · Published 2018-10-02 · Updated 2024-12-12 · CVE-2018-12387

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60.2.2 Firefox versions prior to 62.0.3

Description The issue is related to the JavaScript JIT compiler inlining Array.prototype.push with multiple arguments, resulting in the stack pointer being off by 8 bytes after a bailout. This can leak a memory address to the calling function, potentially used as part of an exploit inside the sandboxed content process. The vulnerability is also described as being related to insufficient input validation in the implementation of the Array.prototype.push method in Firefox and Firefox ESR browsers, which could allow a remote attacker to execute arbitrary code.

Recommendations For Firefox ESR versions prior to 60.2.2, update to version 60.2.2 or later. For Firefox versions prior to 62.0.3, update to version 62.0.3 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2018-2417

ALT-PU-2018-2423

ALT-PU-2019-2324

ALT-PU-2019-2486

BDU:2019-03415

CESA-2018_2881

CESA-2018_2884

CVE-2018-12387

DSA-4310-1

MGASA-2018-0396

OPENSUSE-SU-2018_2996-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:2881

RHSA-2018:2884

RHSA-2018_2881

RHSA-2018_2884

SUSE-SU-2018:3476-1

SUSE-SU-2018:3591-1

SUSE-SU-2018:3591-2

USN-3778-1

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 1935

• 🔥 https://github.com/0vercl0k/CVE-2019-11708 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2019-9810 · Exploit
• 🔥 https://github.com/niklasb/sploits/blob/master/firefox/stack-off-by-8.js · Exploit
• 🔥 https://github.com/xuechiyaobai/CVE-2019-9810-PoC · Exploit
• 🔥 https://github.com/sophoslabs/CVE-2018-18500 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1493903 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://access.redhat.com/errata/RHSA-2018:2884 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4310 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-24 · Vendor Advisory
• https://usn.ubuntu.com/3778-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12387 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0396.html · Security Note
• https://access.redhat.com/errata/RHSA-2018:2881 · Vendor Advisory