Vulnerability in Mozilla Firefox
CVE-2018-5146
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.
EPSS: 0.556 (98.1th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Thunderbird — versions unspecified
Public proof-of-concept exploits
References
- RHSA-2018:0549 (vendor-advisory, x_refsource_REDHAT)
- USN-3604-1 (vendor-advisory, x_refsource_UBUNTU)
- DSA-4143 (vendor-advisory, x_refsource_DEBIAN)
- GLSA-201811-13 (vendor-advisory, x_refsource_GENTOO)
- [debian-lts-announce] 20180326 [SECURITY] [DLA 1319-1] firefox-esr security update (mailing-list, x_refsource_MLIST)
- USN-3545-1 (vendor-advisory, x_refsource_UBUNTU)
- USN-3599-1 (vendor-advisory, x_refsource_UBUNTU)
- www.mozilla.org/security/advisories/mfsa2018-09/ (x_refsource_CONFIRM)
- [debian-lts-announce] 20180329 [SECURITY] [DLA 1327-1] thunderbird security update (mailing-list, x_refsource_MLIST)
- DSA-4155 (vendor-advisory, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2018-5146?
- CVE-2018-5146 is a vulnerability in Mozilla Firefox. Published 2018-06-11.
- Is CVE-2018-5146 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.