PT-2019-1342 · Mozilla+2 · Firefox+2

Markus Vervier · Published 2019-01-29 · Updated 2024-12-12 · CVE-2018-18504

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 65

Description The issue is caused by a buffer overflow in the Texture Client Handler component of the Firefox browser, allowing a remote attacker to potentially cause a denial of service using a specially crafted web page. It can also lead to a crash and out-of-bounds read when a texture client's buffer is freed while still in use during graphic operations, potentially allowing the reading of memory from freed buffers.

Recommendations For versions prior to 65, update to version 65 or later to resolve the issue. As a temporary workaround, consider restricting the use of graphic-intensive operations until a patch is applied.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2019-1173

ALT-PU-2019-2324

ALT-PU-2019-2486

BDU:2019-00680

CVE-2018-18504

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3874-1

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1883

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-18504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18504 · Security Note
• https://ubuntu.com/security/CVE-2018-18505 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00680 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18504 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3874-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18503 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3874-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18502 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18506 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-18500 · Vendor Advisory
• https://usn.ubuntu.com/3874-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18504 · Vendor Advisory