PT-2018-3588 · Mozilla+5 · Firefox Esr+7

James Grant · Published 2018-01-08 · Updated 2024-12-12 · CVE-2018-5129

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.7 Firefox ESR versions prior to 52.7 Firefox versions prior to 59

Description The issue is related to a lack of parameter validation on IPC messages, which can result in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process.

Recommendations For Thunderbird versions prior to 52.7, update to version 52.7 or later. For Firefox ESR versions prior to 52.7, update to version 52.7 or later. For Firefox versions prior to 59, update to version 59 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2018-1481

ALT-PU-2018-1502

ALT-PU-2018-1854

BDU:2021-00375

CESA-2018_0526

CESA-2018_0527

CESA-2018_0647

CESA-2018_0648

CVE-2018-5129

DLA-1308-1

DLA-1327-1

DSA-4139-1

DSA-4155-1

MGASA-2018-0202

MGASA-2018-0203

MGASA-2018-0207

MGASA-2018-0338

OPENSUSE-SU-2018:0818-1

OPENSUSE-SU-2018:0819-1

OPENSUSE-SU-2018_0681-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:0526

RHSA-2018:0527

RHSA-2018:0647

RHSA-2018:0648

RHSA-2018_0526

RHSA-2018_0527

RHSA-2018_0647

RHSA-2018_0648

SUSE-SU-2018:0850-1

SUSE-SU-2018:0907-1

USN-3545-1

USN-3596-1

USN-3596-2

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Red Hat

Suse

Thunderbird

Ubuntu

References · 2041

• https://ubuntu.com/security/CVE-2018-5145 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5146 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-5129 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-07 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-06 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2018-09 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0647 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4139-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4139 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5143 · Vendor Advisory
• https://mozilla.org/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:0819-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3596-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0338 · Vendor Advisory