ByteOS Network

Vulnerability Details :

CVE-2018-5148

Assigner Org ID-f16b083a-5664-49f3-a51e-8d479e5ed7fe

Published At-11 Jun, 2018 | 21:00

Updated At-05 Aug, 2024 | 05:26

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.7.3 and Firefox < 59.0.2.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mozilla

Assigner Org ID:f16b083a-5664-49f3-a51e-8d479e5ed7fe

Published At:11 Jun, 2018 | 21:00

Updated At:05 Aug, 2024 | 05:26

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Mozilla Corporation

Product

Firefox ESR

Versions

Affected

From unspecified before 52.7.3 (custom)

Vendor

Mozilla Corporation

Product

Firefox

Versions

Affected

From unspecified before 59.0.2 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	Use-after-free in compositor

Type: text

CWE ID: N/A

Description: Use-after-free in compositor

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2018:1098	vendor-advisory x_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1440717	x_refsource_CONFIRM
https://usn.ubuntu.com/3609-1/	vendor-advisory x_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4153	vendor-advisory x_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2018-10/	x_refsource_CONFIRM
http://www.securitytracker.com/id/1040574	vdb-entry x_refsource_SECTRACK
https://lists.debian.org/debian-lts-announce/2018/03/msg00023.html	mailing-list x_refsource_MLIST
http://www.securityfocus.com/bid/103506	vdb-entry x_refsource_BID
https://access.redhat.com/errata/RHSA-2018:1099	vendor-advisory x_refsource_REDHAT

Hyperlink: https://access.redhat.com/errata/RHSA-2018:1098

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=1440717

Resource:

x_refsource_CONFIRM

Hyperlink: https://usn.ubuntu.com/3609-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: https://www.debian.org/security/2018/dsa-4153

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: https://www.mozilla.org/security/advisories/mfsa2018-10/

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securitytracker.com/id/1040574

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/03/msg00023.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://www.securityfocus.com/bid/103506

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://access.redhat.com/errata/RHSA-2018:1099

Resource:

vendor-advisory

x_refsource_REDHAT

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://access.redhat.com/errata/RHSA-2018:1098	vendor-advisory x_refsource_REDHAT x_transferred
https://bugzilla.mozilla.org/show_bug.cgi?id=1440717	x_refsource_CONFIRM x_transferred
https://usn.ubuntu.com/3609-1/	vendor-advisory x_refsource_UBUNTU x_transferred
https://www.debian.org/security/2018/dsa-4153	vendor-advisory x_refsource_DEBIAN x_transferred
https://www.mozilla.org/security/advisories/mfsa2018-10/	x_refsource_CONFIRM x_transferred
http://www.securitytracker.com/id/1040574	vdb-entry x_refsource_SECTRACK x_transferred
https://lists.debian.org/debian-lts-announce/2018/03/msg00023.html	mailing-list x_refsource_MLIST x_transferred
http://www.securityfocus.com/bid/103506	vdb-entry x_refsource_BID x_transferred
https://access.redhat.com/errata/RHSA-2018:1099	vendor-advisory x_refsource_REDHAT x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:1098

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://bugzilla.mozilla.org/show_bug.cgi?id=1440717

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://usn.ubuntu.com/3609-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: https://www.debian.org/security/2018/dsa-4153

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: https://www.mozilla.org/security/advisories/mfsa2018-10/

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securitytracker.com/id/1040574

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://lists.debian.org/debian-lts-announce/2018/03/msg00023.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: http://www.securityfocus.com/bid/103506

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:1099

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@mozilla.org

Published At:11 Jun, 2018 | 21:29

Updated At:09 Aug, 2018 | 14:26

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.0

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Debian GNU/Linux

>>debian_linux>>7.0

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>8.0

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_desktop>>6.0

cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_desktop>>7.0

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server>>6.0

cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server>>7.0

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_eus>>7.5

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_workstation>>6.0

cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_workstation>>7.0

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox>>Versions before 59.0.2(exclusive)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_esr>>Versions before 52.7.3(exclusive)

cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>14.04

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>17.10

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-416	Primary	nvd@nist.gov

CWE ID: CWE-416

Type: Primary

Source: nvd@nist.gov