Critical severity9.8NVD Advisory· Published Feb 5, 2019· Updated Jun 17, 2026

CVE-2018-18501

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Thunderbirdv53 versions
unspecified+ 2 more
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <60.5
- (no CPE)range: <60.5
Mozilla Corporation/Firefoxv55 versions
unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <65.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <60.5
- (no CPE)range: <65
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
osv-coords55 versions
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4 pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/mozilla-nss&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.0 pkg:rpm/opensuse/mozilla-nss&distro=openSUSE%20Leap%2015.0
< 60.5.0esr-109.58.3+ 54 more
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 91.1.1-1.1
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 60.5.1-79.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-3.13.1
- (no CPE)range: < 60.5.0-3.24.2
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0-3.20.2
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60.5.0esr-109.58.3
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 3.41.1-58.25.1
- (no CPE)range: < 60-32.5.1
- (no CPE)range: < 60.8.0-lp150.3.62.1
- (no CPE)range: < 3.41.1-lp150.2.20.1

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/106781nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2019:0218nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0219nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0269nvdThird Party Advisory
access.redhat.com/errata/RHSA-2019:0270nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/01/msg00025.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/02/msg00024.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/201903-04nvdThird Party Advisory
usn.ubuntu.com/3874-1/nvdThird Party Advisory
usn.ubuntu.com/3897-1/nvdThird Party Advisory
www.debian.org/security/2019/dsa-4376nvdThird Party Advisory
www.debian.org/security/2019/dsa-4392nvdThird Party Advisory
www.mozilla.org/security/advisories/mfsa2019-01/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2019-02/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2019-03/nvdVendor Advisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.htmlnvd
security.gentoo.org/glsa/201904-07nvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000