High severity8.8NVD Advisory· Published Oct 18, 2018· Updated Jun 17, 2026
CVE-2018-12363
CVE-2018-12363
Description
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
49unspecified+ 2 more
- (no CPE)range: unspecified
- (no CPE)range: <60, <52.9
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <52.9
unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- (no CPE)range: <60.1, <52.9
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <61.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <52.9
- osv-coords25 versionspkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/seamonkey&distro=SUSE%20Package%20Hub%2015pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATApkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 52.9.0esr-109.38.2+ 24 more
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 60.3.0-74.2
- (no CPE)range: < 2.49.4-bp150.3.3.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.1-3.7.1
- (no CPE)range: < 52.9.0esr-3.7.12
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 91.1.1-1.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 92.0-1.2
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Patches
Vulnerability mechanics
References
20- www.securityfocus.com/bid/104560nvdThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1041193nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2018:2112nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:2113nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:2251nvdThird Party Advisory
- access.redhat.com/errata/RHSA-2018:2252nvdThird Party Advisory
- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions RequiredVendor Advisory
- lists.debian.org/debian-lts-announce/2018/06/msg00014.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/07/msg00013.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/201810-01nvdThird Party Advisory
- security.gentoo.org/glsa/201811-13nvdThird Party Advisory
- usn.ubuntu.com/3705-1/nvdThird Party Advisory
- usn.ubuntu.com/3714-1/nvdThird Party Advisory
- www.debian.org/security/2018/dsa-4235nvdThird Party Advisory
- www.debian.org/security/2018/dsa-4244nvdThird Party Advisory
- www.mozilla.org/security/advisories/mfsa2018-15/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2018-16/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2018-17/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2018-18/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2018-19/nvdVendor Advisory
News mentions
0No linked articles in our index yet.