CVE-2018-5177

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability exists in XSLT during number formatting where a negative buffer size may be allocated in some instances, leading to a buffer overflow and crash if it occurs. This vulnerability affects Firefox < 60.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-51788.1A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data. This vulnerabilCVE-2018-51797.5A service worker can send the activate event on itself periodically which allows it to run perpetually, allowing it to monitor activity by uCVE-2018-51807.5A use-after-free vulnerability can occur during WebGL operations. While this results in a potentially exploitable crash, the vulnerability iCVE-2018-51817.5If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open aCVE-2018-51827.5If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specifCVE-2018-51839.8Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer CVE-2018-51847.5Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51856.5Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and ThCVE-2018-51869.8Memory safety bugs present in Firefox 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort thaCVE-2018-51879.8Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that witCVE-2018-51889.8Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and CVE-2018-51897.8Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flip