CVE-2018-18500

CRITICAL

Mozilla Firefox < 65.0 - Use After Free

Title source: rule

Description

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

Exploits (1)

nomisec WORKING POC 61 stars
by sophoslabs · poc
https://github.com/sophoslabs/CVE-2018-18500

References (17)

Scores

CVSS v3 9.8
EPSS 0.2823
EPSS Percentile 96.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-416
Status published
Products (18)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
debian/debian_linux 8.0
debian/debian_linux 9.0
mozilla/firefox < 65.0
mozilla/firefox_esr < 60.5
mozilla/thunderbird < 60.5
redhat/enterprise_linux_desktop 6.0
... and 8 more
Published Feb 05, 2019
Tracked Since Feb 18, 2026