CVE-2018-12361

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/104558	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041193	Third Party Advisory VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1463244	Issue Tracking Permissions Required
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	Third Party Advisory
https://security.gentoo.org/glsa/201810-01	Mitigation Third Party Advisory
https://security.gentoo.org/glsa/201811-13	Mitigation Third Party Advisory
https://usn.ubuntu.com/3705-1/	Third Party Advisory
https://www.debian.org/security/2018/dsa-4295	Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-19/	Vendor Advisory
http://www.securityfocus.com/bid/104558	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041193	Third Party Advisory VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1463244	Issue Tracking Permissions Required
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	Third Party Advisory
https://security.gentoo.org/glsa/201810-01	Mitigation Third Party Advisory
https://security.gentoo.org/glsa/201811-13	Mitigation Third Party Advisory
https://usn.ubuntu.com/3705-1/	Third Party Advisory
https://www.debian.org/security/2018/dsa-4295	Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-19/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mozilla:firefox::::::::
	cpe:2.3:a:mozilla:firefox_esr::::::::
	cpe:2.3:a:mozilla:thunderbird::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:17.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::

History

21 Nov 2024, 03:45

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/104558 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/104558 - Third Party Advisory, VDB Entry
References	~~() http://www.securitytracker.com/id/1041193 - Third Party Advisory, VDB Entry~~	() http://www.securitytracker.com/id/1041193 - Third Party Advisory, VDB Entry
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1463244 - Issue Tracking, Permissions Required~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1463244 - Issue Tracking, Permissions Required
References	~~() https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html - Third Party Advisory~~	() https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html - Third Party Advisory
References	~~() https://security.gentoo.org/glsa/201810-01 - Mitigation, Third Party Advisory~~	() https://security.gentoo.org/glsa/201810-01 - Mitigation, Third Party Advisory
References	~~() https://security.gentoo.org/glsa/201811-13 - Mitigation, Third Party Advisory~~	() https://security.gentoo.org/glsa/201811-13 - Mitigation, Third Party Advisory
References	~~() https://usn.ubuntu.com/3705-1/ - Third Party Advisory~~	() https://usn.ubuntu.com/3705-1/ - Third Party Advisory
References	~~() https://www.debian.org/security/2018/dsa-4295 - Third Party Advisory~~	() https://www.debian.org/security/2018/dsa-4295 - Third Party Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2018-15/ - Vendor Advisory~~	() https://www.mozilla.org/security/advisories/mfsa2018-15/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2018-16/ - Vendor Advisory~~	() https://www.mozilla.org/security/advisories/mfsa2018-16/ - Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2018-19/ - Vendor Advisory~~	() https://www.mozilla.org/security/advisories/mfsa2018-19/ - Vendor Advisory

Information

Published : 2018-10-18 13:29

Updated : 2024-11-21 03:45

NVD link : CVE-2018-12361

Mitre link : CVE-2018-12361

CVE.ORG link : CVE-2018-12361

JSON object : View

Products Affected

mozilla

thunderbird
firefox_esr
firefox

canonical

ubuntu_linux

debian

debian_linux

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2018-12361", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-10-18T13:29:01.147", "references": [{"url": "http://www.securityfocus.com/bid/104558", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "http://www.securitytracker.com/id/1041193", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1463244", "tags": ["Issue Tracking", "Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/201810-01", "tags": ["Mitigation", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "https://security.gentoo.org/glsa/201811-13", "tags": ["Mitigation", "Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "https://usn.ubuntu.com/3705-1/", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.debian.org/security/2018/dsa-4295", "tags": ["Third Party Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-15/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-16/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-19/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "http://www.securityfocus.com/bid/104558", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1041193", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1463244", "tags": ["Issue Tracking", "Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201810-01", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201811-13", "tags": ["Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://usn.ubuntu.com/3705-1/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.debian.org/security/2018/dsa-4295", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-15/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-16/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2018-19/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61."}, {"lang": "es", "value": "Puede ocurrir un desbordamiento de enteros en el c\u00f3digo SwizzleData al calcular tama\u00f1os de b\u00fafer. El valor desbordado se emplea para posteriores c\u00e1lculos de gr\u00e1ficos cuando sus entradas no se sanean, lo que resulta en un cierre inesperado potencialmente explotable. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 60, Firefox ESR en versiones anteriores a la 60.1 y Firefox en versiones anteriores a la 61."}], "lastModified": "2024-11-21T03:45:03.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F47E7EA-86AF-46A8-8E17-3360A8AE8492", "versionEndExcluding": "61.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C033F179-E43B-482A-9B61-AFC2F1F7327F", "versionEndExcluding": "60.1"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FBD136C-202C-430B-876E-9D10972AA6C4", "versionEndExcluding": "60.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}

8.8 /10