Lucene search

K
ubuntucveUbuntu.comUB:CVE-2018-18500
HistoryJan 30, 2019 - 12:00 a.m.

CVE-2018-18500

2019-01-3000:00:00
ubuntu.com
ubuntu.com
13
cve-2018-18500
thunderbird
firefox esr
firefox
html5 stream parsing
use-after-free vulnerability
exploitable crash
spidermonkey javascript engine
unix

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.226

Percentile

96.6%

A use-after-free vulnerability can occur while parsing an HTML5 stream in
concert with custom HTML elements. This results in the stream parser object
being freed while still in use, leading to a potentially exploitable crash.
This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and
Firefox < 65.

Notes

Author Note
tyhicks mozjs contains a copy of the SpiderMonkey JavaScript engine
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfirefox< 65.0+build2-0ubuntu0.18.04.1UNKNOWN
ubuntu18.10noarchfirefox< 65.0+build2-0ubuntu0.18.10.1UNKNOWN
ubuntu19.04noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu19.10noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu20.04noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu20.10noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu21.04noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu21.10noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu22.04noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
ubuntu22.10noarchfirefox< 65.0+build2-0ubuntu1UNKNOWN
Rows per page:
1-10 of 301

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.226

Percentile

96.6%