CVE-2018-5129

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process. This vulnerability affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.

Metrics

CVSS 3.0 8.6/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MozillaThunderbird>= unspecified, < 52.7
MozillaFirefox ESR>= unspecified, < 52.7
MozillaFirefox>= unspecified, < 59

References

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51308.8When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triCVE-2018-51315.9Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" CVE-2018-51326.5The Find API for WebExtensions can search some privileged pages, such as "about:debugging", if these pages are open in a tab. This could allCVE-2018-51336.5If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not saniCVE-2018-51347.5WebExtensions may use "view-source:" URLs to view local "file:" URL content, as well as content stored in "about:cache", bypassing restrictiCVE-2018-51357.5WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts wherCVE-2018-51367.5A shared worker created from a "data:" URL in one tab can be shared by another tab with a different origin, bypassing the same-origin policyCVE-2018-51377.5A legacy extension's non-contentaccessible, defined resources can be loaded by an arbitrary web page through script. This script does this bCVE-2018-51385.3A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Custom Tab (a browser paCVE-2018-51405.3Image for moz-icons can be accessed through the "moz-icon:" protocol through script in web content even when otherwise prohibited. This coulCVE-2018-51418.2A vulnerability in the notifications Push API where notifications can be sent through service workers by web content without direct user intCVE-2018-51425.3If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not pr
CVE-2018-5129: High severity, CVSS 8.6 | Vulnix