Critical severity9.8NVD Advisory· Published Oct 18, 2018· Updated Jun 17, 2026

CVE-2018-5188

Description

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Thunderbirdv53 versions
unspecified+ 2 more
- (no CPE)range: unspecified
- (no CPE)range: < 60, < 52.9
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <52.9
Mozilla Corporation/Firefoxv55 versions
unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- (no CPE)range: <61
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <61.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <52.9
osv-coords25 versions
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-LTSS pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012 pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCL pkg:rpm/suse/seamonkey&distro=SUSE%20Package%20Hub%2015 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4 pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP3-TERADATA pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3 pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed
< 52.9.0esr-109.38.2+ 24 more
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 60.3.0-74.2
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 52.9.1-3.7.1
- (no CPE)range: < 52.9.0esr-3.7.12
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 2.49.4-bp150.3.3.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 91.1.1-1.1
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-109.38.2
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 52.9.0esr-72.38.6
- (no CPE)range: < 92.0-1.2
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Canonical/Ubuntu Linux4 versions
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Red Hat/Enterprise Linux Desktop2 versions
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server2 versions
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Aus
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Eus2 versions
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Server Tus
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Red Hat/Enterprise Linux Workstation2 versions
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/104555nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:2112nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2113nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2251nvdThird Party Advisory
access.redhat.com/errata/RHSA-2018:2252nvdThird Party Advisory
bugzilla.mozilla.org/buglist.cginvdIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2018/06/msg00014.htmlnvdMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2018/07/msg00013.htmlnvdMailing ListThird Party Advisory
security.gentoo.org/glsa/201810-01nvdThird Party Advisory
security.gentoo.org/glsa/201811-13nvdThird Party Advisory
usn.ubuntu.com/3705-1/nvdThird Party Advisory
usn.ubuntu.com/3714-1/nvdThird Party Advisory
usn.ubuntu.com/3749-1/nvdThird Party Advisory
www.debian.org/security/2018/dsa-4244nvdThird Party Advisory
www.mozilla.org/security/advisories/mfsa2018-15/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-16/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-17/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-18/nvdVendor Advisory
www.mozilla.org/security/advisories/mfsa2018-19/nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000