CVE-2018-5095
CVE-2018-5095
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.
CVSS 9.8 · Critical · EPSS 4.1% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
thunderbird
- Versions
- ≥ unspecified, < 52.6: Affected (custom)
Update to 52.6
firefox esr
- Versions
- ≥ unspecified, < 52.6: Affected (custom)
Update to 52.6
firefox
- Versions
- ≥ unspecified, < 58: Affected (custom)
Update to 58
firefox-esr Debian:12
- Affected ranges
- ECOSYSTEM: < 52.6.0esr-1
Update to 52.6.0esr-1
firefox-esr Debian:13
- Affected ranges
- ECOSYSTEM: < 52.6.0esr-1
Update to 52.6.0esr-1
firefox-esr Debian:14
- Affected ranges
- ECOSYSTEM: < 52.6.0esr-1
Update to 52.6.0esr-1
thunderbird Debian:12
- Affected ranges
- ECOSYSTEM: < 1:52.6.0-1
Update to 1:52.6.0-1
thunderbird Debian:13
- Affected ranges
- ECOSYSTEM: < 1:52.6.0-1
Update to 1:52.6.0-1
thunderbird Debian:14
- Affected ranges
- ECOSYSTEM: < 1:52.6.0-1
Update to 1:52.6.0-1
firefox Ubuntu:14.04:LTS
- Versions
- 24.0+build1-0ubuntu1
- 25.0+build3-0ubuntu0.13.10.1
- 28.0~b2+build1-0ubuntu2
- 28.0+build1-0ubuntu1
- 28.0+build2-0ubuntu1
- 28.0+build2-0ubuntu2
- 29.0+build1-0ubuntu0.14.04.2
- 30.0+build1-0ubuntu0.14.04.3
- 31.0+build1-0ubuntu0.14.04.1
- 32.0+build1-0ubuntu0.14.04.1
- 32.0.3+build1-0ubuntu0.14.04.1
- 33.0+build2-0ubuntu0.14.04.1
- 34.0+build2-0ubuntu0.14.04.1
- 35.0+build3-0ubuntu0.14.04.2
- 35.0.1+build1-0ubuntu0.14.04.1
- 36.0+build2-0ubuntu0.14.04.4
- 36.0.1+build2-0ubuntu0.14.04.1
- 36.0.4+build1-0ubuntu0.14.04.1
- 37.0+build2-0ubuntu0.14.04.1
- 37.0.1+build1-0ubuntu0.14.04.1
- 37.0.2+build1-0ubuntu0.14.04.1
- 38.0+build3-0ubuntu0.14.04.1
- 39.0+build5-0ubuntu0.14.04.1
- 39.0.3+build2-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.4
- 40.0.3+build1-0ubuntu0.14.04.1
- 41.0+build3-0ubuntu0.14.04.1
- 41.0.1+build2-0ubuntu0.14.04.1
- 41.0.2+build2-0ubuntu0.14.04.1
- 42.0+build2-0ubuntu0.14.04.1
- 43.0+build1-0ubuntu0.14.04.1
- 43.0.4+build3-0ubuntu0.14.04.1
- 44.0+build3-0ubuntu0.14.04.1
- 44.0.1+build2-0ubuntu0.14.04.1
- 44.0.2+build1-0ubuntu0.14.04.1
- 45.0+build2-0ubuntu0.14.04.1
- 45.0.1+build1-0ubuntu0.14.04.2
- 45.0.2+build1-0ubuntu0.14.04.1
- 46.0+build5-0ubuntu0.14.04.2
- 46.0.1+build1-0ubuntu0.14.04.3
- 47.0+build3-0ubuntu0.14.04.1
- 48.0+build2-0ubuntu0.14.04.1
- 49.0+build4-0ubuntu0.14.04.1
- 49.0.2+build2-0ubuntu0.14.04.1
- 50.0+build2-0ubuntu0.14.04.2
- 50.0.2+build1-0ubuntu0.14.04.1
- 50.1.0+build2-0ubuntu0.14.04.1
- 51.0.1+build2-0ubuntu0.14.04.1
- 51.0.1+build2-0ubuntu0.14.04.2
- 52.0+build2-0ubuntu0.14.04.1
- 52.0.1+build2-0ubuntu0.14.04.1
- 52.0.2+build1-0ubuntu0.14.04.1
- 53.0+build6-0ubuntu0.14.04.1
- 53.0.2+build1-0ubuntu0.14.04.2
- 53.0.3+build1-0ubuntu0.14.04.2
- 54.0+build3-0ubuntu0.14.04.1
- 55.0.1+build2-0ubuntu0.14.04.2
- 55.0.2+build1-0ubuntu0.14.04.1
- 56.0+build6-0ubuntu0.14.04.1
- 56.0+build6-0ubuntu0.14.04.2
- 57.0+build4-0ubuntu0.14.04.4
- 57.0+build4-0ubuntu0.14.04.5
- 57.0.1+build2-0ubuntu0.14.04.1
- 57.0.3+build1-0ubuntu0.14.04.1
- 57.0.4+build1-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 58.0+build6-0ubuntu0.14.04.1
Update to 58.0+build6-0ubuntu0.14.04.1
thunderbird Ubuntu:14.04:LTS
- Versions
- 1:24.0+build1-0ubuntu1
- 1:24.0+build1-0ubuntu2
- 1:24.1.1+build1-0ubuntu0.13.10.1
- 1:24.1.1+build1-0ubuntu1
- 1:24.2.0+build1-0ubuntu1
- 1:24.4.0+build1-0ubuntu1
- 1:24.5.0+build1-0ubuntu0.14.04.1
- 1:24.6.0+build1-0ubuntu0.14.04.1
- 1:31.0+build1-0ubuntu0.14.04.1
- 1:31.1.1+build1-0ubuntu0.14.04.1
- 1:31.1.2+build1-0ubuntu0.14.04.1
- 1:31.2.0+build2-0ubuntu0.14.04.1
- 1:31.3.0+build1-0ubuntu0.14.04.1
- 1:31.4.0+build1-0ubuntu0.14.04.1
- 1:31.5.0+build1-0ubuntu0.14.04.1
- 1:31.6.0+build1-0ubuntu0.14.04.1
- 1:31.7.0+build1-0ubuntu0.14.04.1
- 1:31.8.0+build1-0ubuntu0.14.04.1
- 1:38.2.0+build1-0ubuntu0.14.04.1
- 1:38.3.0+build1-0ubuntu0.14.04.1
- 1:38.4.0+build3-0ubuntu0.14.04.1
- 1:38.5.1+build2-0ubuntu0.14.04.1
- 1:38.6.0+build1-0ubuntu0.14.04.1
- 1:38.7.2+build1-0ubuntu0.14.04.1
- 1:38.8.0+build1-0ubuntu0.14.04.1
- 1:45.2.0+build1-0ubuntu0.14.04.3
- 1:45.3.0+build1-0ubuntu0.14.04.4
- 1:45.4.0+build1-0ubuntu0.14.04.1
- 1:45.5.1+build1-0ubuntu0.14.04.1
- 1:45.7.0+build1-0ubuntu0.14.04.1
- 1:45.8.0+build1-0ubuntu0.14.04.1
- 1:52.1.1+build1-0ubuntu0.14.04.1
- 1:52.2.1+build1-0ubuntu0.14.04.1
- 1:52.3.0+build1-0ubuntu0.14.04.1
- 1:52.4.0+build1-0ubuntu0.14.04.2
- 1:52.5.0+build1-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 1:52.6.0+build1-0ubuntu0.14.04.1
Update to 1:52.6.0+build1-0ubuntu0.14.04.1
firefox Ubuntu:16.04:LTS
- Versions
- 41.0.2+build2-0ubuntu1
- 42.0+build2-0ubuntu1
- 44.0+build3-0ubuntu2
- 44.0.1+build1-0ubuntu1
- 44.0.2+build1-0ubuntu1
- 45.0+build2-0ubuntu1
- 45.0.1+build1-0ubuntu1
- 45.0.2+build1-0ubuntu1
- 46.0+build5-0ubuntu0.16.04.2
- 46.0.1+build1-0ubuntu0.16.04.2
- 47.0+build3-0ubuntu0.16.04.1
- 48.0+build2-0ubuntu0.16.04.1
- 49.0+build4-0ubuntu0.16.04.1
- 49.0.2+build2-0ubuntu0.16.04.2
- 50.0+build2-0ubuntu0.16.04.2
- 50.0.2+build1-0ubuntu0.16.04.1
- 50.1.0+build2-0ubuntu0.16.04.1
- 51.0.1+build2-0ubuntu0.16.04.1
- 51.0.1+build2-0ubuntu0.16.04.2
- 52.0+build2-0ubuntu0.16.04.1
- 52.0.1+build2-0ubuntu0.16.04.1
- 52.0.2+build1-0ubuntu0.16.04.1
- 53.0+build6-0ubuntu0.16.04.1
- 53.0.2+build1-0ubuntu0.16.04.2
- 53.0.3+build1-0ubuntu0.16.04.2
- 54.0+build3-0ubuntu0.16.04.1
- 55.0.1+build2-0ubuntu0.16.04.2
- 55.0.2+build1-0ubuntu0.16.04.1
- 56.0+build6-0ubuntu0.16.04.1
- 56.0+build6-0ubuntu0.16.04.2
- 57.0+build4-0ubuntu0.16.04.5
- 57.0+build4-0ubuntu0.16.04.6
- 57.0.1+build2-0ubuntu0.16.04.1
- 57.0.3+build1-0ubuntu0.16.04.1
- 57.0.4+build1-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 58.0+build6-0ubuntu0.16.04.1
Update to 58.0+build6-0ubuntu0.16.04.1
thunderbird Ubuntu:16.04:LTS
- Versions
- 1:38.3.0+build1-0ubuntu2
- 1:38.5.1+build2-0ubuntu1
- 1:38.6.0+build1-0ubuntu1
- 1:38.7.2+build1-0ubuntu0.16.04.1
- 1:38.8.0+build1-0ubuntu0.16.04.1
- 1:45.2.0+build1-0ubuntu0.16.04.1
- 1:45.3.0+build1-0ubuntu0.16.04.2
- 1:45.4.0+build1-0ubuntu0.16.04.1
- 1:45.5.1+build1-0ubuntu0.16.04.1
- 1:45.7.0+build1-0ubuntu0.16.04.1
- 1:45.8.0+build1-0ubuntu0.16.04.1
- 1:52.1.1+build1-0ubuntu0.16.04.1
- 1:52.2.1+build1-0ubuntu0.16.04.1
- 1:52.3.0+build1-0ubuntu0.16.04.1
- 1:52.4.0+build1-0ubuntu0.16.04.2
- 1:52.5.0+build1-0ubuntu0.16.04.1
- Affected ranges
- ECOSYSTEM: < 1:52.6.0+build1-0ubuntu0.16.04.1
Update to 1:52.6.0+build1-0ubuntu0.16.04.1
firefox Ubuntu:18.04:LTS
- Versions
- 56.0+build6-0ubuntu1
- 57.0.1+build2-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 59.0.1+build1-0ubuntu1
Update to 59.0.1+build1-0ubuntu1
thunderbird Ubuntu:18.04:LTS
- Versions
- 1:52.4.0+build1-0ubuntu2
- Affected ranges
- ECOSYSTEM: < 1:52.6.0+build1-0ubuntu1
Update to 1:52.6.0+build1-0ubuntu1
Original sources
- https://www.mozilla.org/security/advisories/mfsa2018-03/
- http://www.securitytracker.com/id/1040270
- https://lists.debian.org/debian-lts-announce/2018/01/msg00036.html
- http://www.securityfocus.com/bid/102783
- https://www.debian.org/security/2018/dsa-4096
- https://access.redhat.com/errata/RHSA-2018:0262
- https://usn.ubuntu.com/3544-1/
- https://www.mozilla.org/security/advisories/mfsa2018-04/
- https://access.redhat.com/errata/RHSA-2018:0122
- https://www.mozilla.org/security/advisories/mfsa2018-02/
- https://lists.debian.org/debian-lts-announce/2018/01/msg00030.html
- https://www.debian.org/security/2018/dsa-4102
- https://bugzilla.mozilla.org/show_bug.cgi?id=1418447
- https://nvd.nist.gov/vuln/detail/CVE-2018-5095