Unrated severityNVD Advisory· Published Jun 11, 2018· Updated Aug 5, 2024

CVE-2018-5146

Description

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.

Affected products

osv-coords28 versions
pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/libvorbis&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012
< 1.3.3-10.6.1+ 27 more
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.2.0-79.20.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.2.0-79.20.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.2.0-79.20.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 1.3.3-10.6.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-72.27.2
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7.3esr-109.25.1
- (no CPE)range: < 52.7-57.1
Mozilla Corporation/Firefoxv5
Range: unspecified
Mozilla Corporation/Thunderbirdv5
Range: unspecified
Mozilla/Firefox ESRv5
Range: unspecified

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

access.redhat.com/errata/RHSA-2018:0549mitrevendor-advisoryx_refsource_REDHAT
access.redhat.com/errata/RHSA-2018:0647mitrevendor-advisoryx_refsource_REDHAT
access.redhat.com/errata/RHSA-2018:0648mitrevendor-advisoryx_refsource_REDHAT
access.redhat.com/errata/RHSA-2018:0649mitrevendor-advisoryx_refsource_REDHAT
access.redhat.com/errata/RHSA-2018:1058mitrevendor-advisoryx_refsource_REDHAT
security.gentoo.org/glsa/201811-13mitrevendor-advisoryx_refsource_GENTOO
usn.ubuntu.com/3545-1/mitrevendor-advisoryx_refsource_UBUNTU
usn.ubuntu.com/3599-1/mitrevendor-advisoryx_refsource_UBUNTU
usn.ubuntu.com/3604-1/mitrevendor-advisoryx_refsource_UBUNTU
www.debian.org/security/2018/dsa-4140mitrevendor-advisoryx_refsource_DEBIAN
www.debian.org/security/2018/dsa-4143mitrevendor-advisoryx_refsource_DEBIAN
www.debian.org/security/2018/dsa-4155mitrevendor-advisoryx_refsource_DEBIAN
www.securityfocus.com/bid/103432mitrevdb-entryx_refsource_BID
www.securitytracker.com/id/1040544mitrevdb-entryx_refsource_SECTRACK
bugzilla.mozilla.org/show_bug.cgimitrex_refsource_CONFIRM
lists.debian.org/debian-lts-announce/2018/03/msg00022.htmlmitremailing-listx_refsource_MLIST
lists.debian.org/debian-lts-announce/2018/03/msg00029.htmlmitremailing-listx_refsource_MLIST
lists.debian.org/debian-lts-announce/2018/04/msg00033.htmlmitremailing-listx_refsource_MLIST
www.mozilla.org/security/advisories/mfsa2018-08/mitrex_refsource_CONFIRM
www.mozilla.org/security/advisories/mfsa2018-09/mitrex_refsource_CONFIRM

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.045
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000