crítica
CVE-2018-5147
The libtremor library has the same flaw as CVE-2018-5146. This library ...
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Ubuntu (media).
Descripción
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | firefox-esr, libvorbisidec | 52.7.2esr-1 y 1 más |
| debian 12 | firefox-esr, libvorbisidec | 52.7.2esr-1 y 1 más |
| debian 13 | firefox-esr, libvorbisidec | 52.7.2esr-1 y 1 más |
| debian 14 | firefox-esr, libvorbisidec | 52.7.2esr-1 y 1 más |
| debian 7 | firefox-esr, libvorbisidec | 52.7.2esr-1~deb7u1 y 1 más |
| debian 8 | firefox-esr, libvorbisidec | 52.7.2esr-1~deb8u1 y 1 más |
| debian 9 | firefox-esr, libvorbisidec | 52.7.2esr-1~deb9u1 y 1 más |
| echo | firefox-esr, libvorbisidec | 52.7.2esr-1 y 1 más |
| ubuntu 14.04 | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.14.04.1 |
| ubuntu 14.04-ESM | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.14.04.1 |
| ubuntu 16.04 | firefox, libvorbisidec | 59.0.1+build1-0ubuntu0.16.04.1 y 1 más |
| ubuntu 16.04-ESM | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.16.04.1 |
Mostrar las 25 entradas de 16 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | firefox-esr | 52.7.2esr-1 |
| debian 11 | libvorbisidec | 1.2.1+git20180316-1 |
| debian 12 | firefox-esr | 52.7.2esr-1 |
| debian 12 | libvorbisidec | 1.2.1+git20180316-1 |
| debian 13 | firefox-esr | 52.7.2esr-1 |
| debian 13 | libvorbisidec | 1.2.1+git20180316-1 |
| debian 14 | firefox-esr | 52.7.2esr-1 |
| debian 14 | libvorbisidec | 1.2.1+git20180316-1 |
| debian 7 | firefox-esr | 52.7.2esr-1~deb7u1 |
| debian 7 | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1 |
| debian 8 | firefox-esr | 52.7.2esr-1~deb8u1 |
| debian 8 | libvorbisidec | 1.0.2+svn18153-1~deb8u2 |
| debian 9 | firefox-esr | 52.7.2esr-1~deb9u1 |
| debian 9 | libvorbisidec | 1.0.2+svn18153-1+deb9u1 |
| echo | firefox-esr | 52.7.2esr-1 |
| echo | libvorbisidec | 1.2.1+git20180316-1 |
| ubuntu 14.04 | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.14.04.1 |
| ubuntu 14.04-ESM | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.14.04.1 |
| ubuntu 16.04 | firefox | 59.0.1+build1-0ubuntu0.16.04.1 |
| ubuntu 16.04 | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.16.04.1 |
| ubuntu 16.04-ESM | libvorbisidec | 1.0.2+svn18153-0.2+deb7u1build0.16.04.1 |
| ubuntu 17.10 | libvorbisidec | 1.0.2+svn18153-1+deb9u1build0.17.10.1 |
| ubuntu 18.04 | firefox | 59.0.1+build1-0ubuntu1 |
| ubuntu 18.10 | firefox | 59.0.1+build1-0ubuntu1 |
| ubuntu 19.04 | firefox | 59.0.1+build1-0ubuntu1 |
Referencias
- http://www.securityfocus.com/bid/103432
- http://www.securitytracker.com/id/1040544
- https://bugzilla.mozilla.org/show_bug.cgi?id=1446365
- https://git.xiph.org/?p=tremor.git;a=commit;h=562307a4a7082e24553f3d2c55dab397a17c4b4f
- https://lists.debian.org/debian-lts-announce/2018/03/msg00016.html
- https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html
- https://www.cve.org/CVERecord?id=CVE-2018-5147
- https://www.debian.org/security/2018/dsa-4141