CVE-2018-5187

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 60
Mozilla	Firefox ESR	>= unspecified, < 60.1
Mozilla	Firefox	>= unspecified, < 61

References

http://www.securityfocus.com/bid/104556Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1461324%2C1414829%2C1395246%2C1467938%2C1461619%2C1425930%2C1438556%2C1454285%2C1459568%2C1463884Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201810-01Third Party Advisory
https://security.gentoo.org/glsa/201811-13Third Party Advisory
https://usn.ubuntu.com/3705-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4295Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory
http://www.securityfocus.com/bid/104556Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1461324%2C1414829%2C1395246%2C1467938%2C1461619%2C1425930%2C1438556%2C1454285%2C1459568%2C1463884Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201810-01Third Party Advisory
https://security.gentoo.org/glsa/201811-13Third Party Advisory
https://usn.ubuntu.com/3705-1/Third Party Advisory
https://www.debian.org/security/2018/dsa-4295Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory

Timeline

Published: Oct 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-51889.8Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and CVE-2018-51897.8Race condition in Jungo Windriver 12.5.1 allows local users to cause a denial of service (buffer overflow) or gain system privileges by flip CVE-2018-51909.8PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified coo CVE-2018-51959.8Hancom NEO versions 9.6.1.5183 and earlier have a buffer Overflow vulnerability that leads remote attackers to execute arbitrary commands wh CVE-2018-51967.8Alzip 10.76.0.0 and earlier is vulnerable to a stack overflow caused by improper bounds checking. By persuading a victim to open a specially CVE-2018-51977.8A vulnerability in the ExtCommon.dll user extension module version 9.2, 9.2.1, 9.2.2 of Xplatform ActiveX could allow attacker to perform a CVE-2018-51988.1In Veraport G3 ALL on MacOS, a race condition when calling the Veraport API allow remote attacker to cause arbitrary file download and execu CVE-2018-51998.8In Veraport G3 ALL on MacOS, due to insufficient domain validation, It is possible to overwrite installation file to malicious file. A remot CVE-2018-52007.8KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The pro CVE-2018-52015.5Hancom Office 2018 10.0.0.8214 and earlier, Hancom Office NEO 9.6.1.10472 and earlier, Hancom Office 2014 9.1.1.4540 and earlier, Hancom Off CVE-2018-52027.8SKCertService 2.5.5 and earlier contains a vulnerability that could allow remote attacker to execute arbitrary code. This vulnerability exis CVE-2018-52039.8DEXTUploadX5 version Between 1.0.0.0 and 2.2.0.0 contains a vulnerability that could allow remote attacker to download and execute remote ar