CVE-2018-12362

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
MozillaThunderbird>= unspecified, < 60; >= unspecified, < 52.9
MozillaFirefox ESR>= unspecified, < 60.1; >= unspecified, < 52.9
MozillaFirefox>= unspecified, < 61

References

Timeline

Published
Oct 18, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-123638.8A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old documentCVE-2018-123648.8NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 rCVE-2018-123656.5A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consentCVE-2018-123666.5An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This couCVE-2018-123674.3In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure preCVE-2018-123688.1Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded fromCVE-2018-123699.8WebExtensions bundled with embedded experiments were not correctly checked for proper authorization. This allowed a malicious WebExtension tCVE-2018-12379.8Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LCVE-2018-123708.8In Reader View SameSite cookie protections are not checked on exiting. This allows for a payload to be triggered when Reader View is exited CVE-2018-123718.8An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. TCVE-2018-123726.5Decrypted S/MIME parts, when included in HTML crafted for an attack, can leak plaintext when included in a a HTML reply/forward. This vulnerCVE-2018-123736.5dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerabili
CVE-2018-12362: High severity, CVSS 8.8 | Vulnix