CVE-2018-12379

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 62
MozillaFirefox ESR>= unspecified, < 60.2
MozillaThunderbird>= unspecified, < 60.2.1

References

Timeline

Published
Oct 18, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-12387.5Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent (LIA). This component is uCVE-2018-123815.3Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message's mail columns are CVE-2018-123825.3The displayed addressbar URL can be spoofed on Firefox for Android using a javascript: URI in concert with JavaScript to insert text before CVE-2018-123835.5If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessibleCVE-2018-123845.9When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. ThCVE-2018-123857.0A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profileCVE-2018-123868.1A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remCVE-2018-123879.1A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer beiCVE-2018-123888.8Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corCVE-2018-123898.8Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memoCVE-2018-12397.2Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. CVE-2018-123909.8Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed e
CVE-2018-12379: High severity, CVSS 7.8 | Vulnix