CVE-2018-18505

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

Metrics

CVSS 3.0 10.0/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-185065.9When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this CVE-2018-185086.5In Network Security Services (NSS) before 3.36.7 and before 3.41.1, a malformed signature can cause a crash due to a null dereference, resul CVE-2018-185095.3A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even i CVE-2018-18519.8IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by imp CVE-2018-185106.5The about:crashcontent and about:crashparent pages can be triggered by web content. These pages are used to crash the loaded page or the bro CVE-2018-185114.3Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note CVE-2018-185129.8A use-after-free vulnerability can occur while playing a sound notification in Thunderbird. The memory storing the sound data is immediately CVE-2018-185137.5A crash can occur when processing a crafted S/MIME message or an XPI package containing a crafted signature. This can be used as a denial-of CVE-2018-185174.8Citrix NetScaler Gateway 10.5.x before 10.5.69.003, 11.1.x before 11.1.59.004, 12.0.x before 12.0.58.7, and 12.1.x before 12.1.49.1 has XSS.CVE-2018-185197.8BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe CVE-2018-185206.5An Invalid Memory Address Dereference exists in the function elf_end in libelf in elfutils through v0.174. Although eu-size is intended to s CVE-2018-185215.5Divide-by-zero vulnerabilities in the function arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers to cause a denial of