CVE-2018-5126

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs were reported in Firefox 58. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 59.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51278.8A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script. This results in a potentially exploitable crash.CVE-2018-51289.8A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations. This results in CVE-2018-51298.6A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentialCVE-2018-51308.8When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triCVE-2018-51315.9Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" CVE-2018-51326.5The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allCVE-2018-51336.5If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not saniCVE-2018-51347.5WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictiCVE-2018-51357.5WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts wherCVE-2018-51367.5A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policyCVE-2018-51377.5A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this bCVE-2018-51385.3A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser pa
CVE-2018-5126: Critical severity, CVSS 9.8 | Vulnix