CVE-2018-5145

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 52.7 and Thunderbird < 52.7.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 52.7
MozillaThunderbird>= unspecified, < 52.7

References

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51468.8An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects FirefoCVE-2018-51479.8The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platformsCVE-2018-51489.8A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a refereCVE-2018-51509.8Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruptCVE-2018-51519.8Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effoCVE-2018-51526.5WebExtensions with the appropriate permissions can attach content scripts to Mozilla sites such as accounts.firefox.com and listen to networCVE-2018-51537.5If websocket data is sent with mixed text and binary in a single message, the binary data can be corrupted. This can result in an out-of-bouCVE-2018-51549.8A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This results in a potentially eCVE-2018-51559.8A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitCVE-2018-51569.8A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result iCVE-2018-51577.5Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This couldCVE-2018-51588.8The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafte
CVE-2018-5145: Critical severity, CVSS 9.8 | Vulnix