p PatchFirst

CVE-2018-12379

CVE-2018-12379

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

CVSS 7.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • firefox

    Versions
    • ≥ unspecified, < 62: Affected (custom)

    Update to 62

  • firefox esr

    Versions
    • ≥ unspecified, < 60.2: Affected (custom)

    Update to 60.2

  • thunderbird

    Versions
    • ≥ unspecified, < 60.2.1: Affected (custom)

    Update to 60.2.1

  • firefox-esr Debian:12

    Affected ranges
    • ECOSYSTEM: < 60.2.0esr-1

    Update to 60.2.0esr-1

  • firefox-esr Debian:13

    Affected ranges
    • ECOSYSTEM: < 60.2.0esr-1

    Update to 60.2.0esr-1

  • firefox-esr Debian:14

    Affected ranges
    • ECOSYSTEM: < 60.2.0esr-1

    Update to 60.2.0esr-1

  • thunderbird Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:60.2.1-1

    Update to 1:60.2.1-1

  • thunderbird Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:60.2.1-1

    Update to 1:60.2.1-1

  • thunderbird Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:60.2.1-1

    Update to 1:60.2.1-1

Original sources

Check your server →