CVE-2018-18504

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations. This results is a potentially exploitable crash and the possibility of reading from the memory of the freed buffers. This vulnerability affects Firefox < 65.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/106773Third Party Advisory, VDB Entry
https://usn.ubuntu.com/3874-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-01/Vendor Advisory
http://www.securityfocus.com/bid/106773Third Party Advisory, VDB Entry
https://usn.ubuntu.com/3874-1/Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-01/Vendor Advisory

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-1850510.0An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endp CVE-2018-185065.9When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this CVE-2018-185086.5In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resul CVE-2018-185095.3A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even i CVE-2018-18519.8IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by imp CVE-2018-185106.5The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the bro CVE-2018-185114.3Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note CVE-2018-185129.8A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately CVE-2018-185137.5A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of CVE-2018-185174.8Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.CVE-2018-185197.8BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe CVE-2018-185206.5An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to s