CVE - CVE-2018-12379

CVE-ID
CVE-2018-12379	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:105280 URL:http://www.securityfocus.com/bid/105280 CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=1473113 CONFIRM:https://www.mozilla.org/security/advisories/mfsa2018-20/ CONFIRM:https://www.mozilla.org/security/advisories/mfsa2018-21/ CONFIRM:https://www.mozilla.org/security/advisories/mfsa2018-25/ DEBIAN:DSA-4327 URL:https://www.debian.org/security/2018/dsa-4327 GENTOO:GLSA-201810-01 URL:https://security.gentoo.org/glsa/201810-01 GENTOO:GLSA-201811-13 URL:https://security.gentoo.org/glsa/201811-13 MLIST:[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update URL:https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html REDHAT:RHSA-2018:2692 URL:https://access.redhat.com/errata/RHSA-2018:2692 REDHAT:RHSA-2018:2693 URL:https://access.redhat.com/errata/RHSA-2018:2693 REDHAT:RHSA-2018:3403 URL:https://access.redhat.com/errata/RHSA-2018:3403 REDHAT:RHSA-2018:3458 URL:https://access.redhat.com/errata/RHSA-2018:3458 SECTRACK:1041610 URL:http://www.securitytracker.com/id/1041610
Assigning CNA
Mozilla Corporation
Date Record Created
20180614	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20180614)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)