PT-2018-3747 · Mozilla+5 · Firefox+5

Jesse Schwartzentruber · Published 2018-03-26 · Updated 2024-12-12 · CVE-2018-5148

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.7.3 Firefox versions prior to 59.0.2

Description A use-after-free issue can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one, resulting in a potentially exploitable crash. This issue may allow a remote attacker to execute arbitrary code.

Recommendations For Firefox ESR versions prior to 52.7.3, update to version 52.7.3 or later. For Firefox versions prior to 59.0.2, update to version 59.0.2 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2018-1496

ALT-PU-2018-1502

ALT-PU-2018-1854

BDU:2021-04143

CESA-2018_1098

CESA-2018_1099

CVE-2018-5148

DLA-1321-1

DSA-4153-1

MGASA-2018-0202

MGASA-2018-0338

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2018:1098

RHSA-2018:1099

RHSA-2018_1098

RHSA-2018_1099

SUSE-SU-2018:0850-1

SUSE-SU-2018:0907-1

USN-3609-1

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 1908

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1098 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1099 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2018-07 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3609-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04143 · Security Note
• https://mozilla.org/security/known-vulnerabilities/firefox-esr · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0338 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0850-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4153 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-5148 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3609-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5148 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-5148 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4153-1 · Vendor Advisory