CVE-2018-12378

CRITICAL

Redhat Enterprise Linux Desktop < 60.2.0 - Use After Free

Title source: rule
STIX 2.1

Description

A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

References (17)

Core 17
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105280
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201810-01
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2693
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201811-13
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4327
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3403
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2018-20/
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041610
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=1459383
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2692
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:3458
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3793-1/
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2018-21/
Vendor Advisory x_refsource_confirm
https://www.mozilla.org/security/advisories/mfsa2018-25/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3761-1/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4287

Scores

CVSS v3 9.8
EPSS 0.0295
EPSS Percentile 86.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (17)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
debian/debian_linux 8.0
debian/debian_linux 9.0
mozilla/firefox < 60.2.0
mozilla/thunderbird < 60.2.1
redhat/enterprise_linux_desktop 6.0
redhat/enterprise_linux_desktop 7.0
redhat/enterprise_linux_server 6.0
... and 7 more
Published Oct 18, 2018
Tracked Since Feb 18, 2026