Critical severity9.8NVD Advisory· Published Feb 28, 2019· Updated Jun 17, 2026

CVE-2018-12405

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox4 versions
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <60.4.0
- (no CPE)range: <64
- (no CPE)range: unspecified
- (no CPE)range: unspecified
Mozilla Corporation/Thunderbird3 versions
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <60.4.0
- (no CPE)range: <60.4
- (no CPE)range: unspecified
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
osv-coords56 versions
pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/mozilla-nspr&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/mozilla-nss&distro=SUSE%20OpenStack%20Cloud%207
< 92.0-1.2+ 55 more
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 91.1.1-1.1
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0-3.21.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.4.0esr-109.55.1
- (no CPE)range: < 60.5.0-3.20.2
- (no CPE)range: < 60.5.1-79.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-3.3.2
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 4.20-19.6.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-3.7.2
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1
- (no CPE)range: < 3.40.1-58.18.1

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106168nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:3831nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:3833nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0159nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0160nvdThird Party Advisory
bugzilla.mozilla.org/buglist.cginvdBroken LinkIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2018/12/msg00002.htmlnvdThird Party Advisory
security.gentoo.org/glsa/201903-04nvdThird Party Advisory
usn.ubuntu.com/3844-1/nvdThird Party Advisory
usn.ubuntu.com/3868-1/nvdThird Party Advisory
www.debian.org/security/2018/dsa-4354nvdThird Party Advisory
www.debian.org/security/2019/dsa-4362nvdThird Party Advisory
www.mozilla.org/security/advisories/mfsa2018-29/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-30/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-31/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000