critique
CVE-2018-12387
Mozilla: stack out-of-bounds read in Array.prototype.push
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat8.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, Red Hat, Oracle. Plus basse selon Ubuntu (moyenne).
Description
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| Oracle Linux 6 | firefox | 60.3.0-1.0.1.el6 |
| Oracle Linux 7 | firefox | 60.2.2-1.0.1.el7_5 |
| debian 11 | firefox-esr | 60.2.2esr-1 |
| debian 12 | firefox-esr | 60.2.2esr-1 |
| debian 13 | firefox-esr | 60.2.2esr-1 |
| debian 14 | firefox-esr | 60.2.2esr-1 |
| debian 9 | firefox-esr | 60.2.2esr-1~deb9u1 |
| echo | firefox-esr | 60.2.2esr-1 |
| ubuntu 14.04 | firefox, thunderbird | 62.0.3+build1-0ubuntu0.14.04.2 et 1 autres |
| ubuntu 16.04 | firefox, thunderbird | 62.0.3+build1-0ubuntu0.16.04.2 et 1 autres |
| ubuntu 18.04 | firefox, thunderbird | 62.0.3+build1-0ubuntu0.18.04.1 et 1 autres |
| ubuntu 18.10 | firefox, thunderbird | 62.0.3+build1-0ubuntu1 et 1 autres |
Afficher les 38 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| Oracle Linux 6 | firefox | 60.3.0-1.0.1.el6 |
| Oracle Linux 7 | firefox | 60.2.2-1.0.1.el7_5 |
| debian 11 | firefox-esr | 60.2.2esr-1 |
| debian 12 | firefox-esr | 60.2.2esr-1 |
| debian 13 | firefox-esr | 60.2.2esr-1 |
| debian 14 | firefox-esr | 60.2.2esr-1 |
| debian 9 | firefox-esr | 60.2.2esr-1~deb9u1 |
| echo | firefox-esr | 60.2.2esr-1 |
| ubuntu 14.04 | firefox | 62.0.3+build1-0ubuntu0.14.04.2 |
| ubuntu 14.04 | thunderbird | 1:60.4.0+build2-0ubuntu0.14.04.1 |
| ubuntu 16.04 | firefox | 62.0.3+build1-0ubuntu0.16.04.2 |
| ubuntu 16.04 | thunderbird | 1:60.4.0+build2-0ubuntu0.16.04.1 |
| ubuntu 18.04 | firefox | 62.0.3+build1-0ubuntu0.18.04.1 |
| ubuntu 18.04 | thunderbird | 1:60.4.0+build2-0ubuntu0.18.04.1 |
| ubuntu 18.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 18.10 | thunderbird | 1:60.4.0+build2-0ubuntu0.18.10.1 |
| ubuntu 19.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 19.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 19.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 19.10 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 20.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 20.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 20.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 20.10 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 21.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 21.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 21.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 21.10 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 22.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 22.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 22.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 22.10 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 23.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 23.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 23.10 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 23.10 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
| ubuntu 24.04 | firefox | 62.0.3+build1-0ubuntu1 |
| ubuntu 24.04 | thunderbird | 1:60.4.0+build2-0ubuntu1 |
Références
- http://www.securityfocus.com/bid/105460
- http://www.securitytracker.com/id/1041770
- https://access.redhat.com/errata/RHSA-2018:2881
- https://access.redhat.com/errata/RHSA-2018:2884
- https://access.redhat.com/security/cve/CVE-2018-12387
- https://bugzilla.mozilla.org/show_bug.cgi?id=1493903
- https://linux.oracle.com/cve/CVE-2018-12387.html
- https://linux.oracle.com/errata/ELSA-2018-3006.html
Les 16 références
- https://nvd.nist.gov/vuln/detail/CVE-2018-12387
- https://security.gentoo.org/glsa/201810-01
- https://ubuntu.com/security/notices/USN-3778-1
- https://usn.ubuntu.com/3778-1/
- https://www.cve.org/CVERecord?id=CVE-2018-12387
- https://www.debian.org/security/2018/dsa-4310
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/#CVE-2018-12387
- https://www.mozilla.org/security/advisories/mfsa2018-24/