Medium severity6.5NVD Advisory· Published Oct 18, 2018· Updated Jun 17, 2026

CVE-2018-12365

Description

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Thunderbirdv53 versions
unspecified+ 2 more
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <52.9
- (no CPE)range: <60, <52.9
Mozilla Corporation/Firefoxv55 versions
unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <61.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <52.9
- (no CPE)range: <60.1, <52.9
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus2 versions
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
osv-coords25 versions
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/seamonkey&distro=SUSE%20Package%20Hub%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed
< 52.9.0esr-3.7.12+ 24 more
- (no CPE)range: < 52.9.0esr-3.7.12
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 2.49.4-bp150.3.3.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 60.3.0-74.2
- (no CPE)range: < 52.9.1-3.7.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 91.1.1-1.1

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/104560nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1041193nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:2112nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2113nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2251nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2252nvdThird Party Advisory
bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions RequiredVendor Advisory
lists.debian.org/debian-lts-announce/2018/06/msg00014.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2018/07/msg00013.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/201810-01nvdThird Party Advisory
security.gentoo.org/glsa/201811-13nvdThird Party Advisory
usn.ubuntu.com/3705-1/nvdThird Party Advisory
usn.ubuntu.com/3714-1/nvdThird Party Advisory
www.debian.org/security/2018/dsa-4235nvdThird Party Advisory
www.debian.org/security/2018/dsa-4244nvdThird Party Advisory
www.mozilla.org/security/advisories/mfsa2018-15/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-16/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-17/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-18/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-19/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000