1. Home
  2. Vulnerabilities
  3. CVE-2018-12361

CVE-2018-12361

CVSS v3.0 8.8 (High)
88% Progress
CVSS v2.0 6.8 (Medium)
68% Progress
EPSS 0.57 % (78th)
0.57% Progress
Affected Products 5
Advisories 12
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

Weaknesses
CWE-190
Integer Overflow or Wraparound
CVE Status
PUBLISHED
CNA
Mozilla Corporation
Published Date
2018-10-18 13:29:01
(6 years ago)
Updated Date
2018-12-06 14:38:54
(5 years ago)

Affected Products

Canonical

Debian

Mozilla

Configuration #1

    CPE23 From Up To
  Mozilla Firefox prior 61.0 version cpe:2.3:a:mozilla:firefox < 61.0
  Mozilla Firefox Esr prior 60.1 version cpe:2.3:a:mozilla:firefox_esr < 60.1
  Mozilla Thunderbird prior 60.0 version cpe:2.3:a:mozilla:thunderbird < 60.0

Configuration #2

    CPE23 From Up To
  Debian Linux 8.0 cpe:2.3:o:debian:debian_linux:8.0
  Debian Linux 9.0 cpe:2.3:o:debian:debian_linux:9.0

Configuration #3

    CPE23 From Up To
  Canonical Ubuntu Linux 14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts
  Canonical Ubuntu Linux 16.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts
  Canonical Ubuntu Linux 17.10 cpe:2.3:o:canonical:ubuntu_linux:17.10
  Canonical Ubuntu Linux 18.04 cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts