CVE-2018-12363

Name
CVE-2018-12363
Description
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
NVD Severity
high
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2018-19/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2018-18/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2018-17/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2018-16/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2018-15/
Issue Tracking https://bugzilla.mozilla.org/show_bug.cgi?id=1464784
Third Party Advisory https://www.debian.org/security/2018/dsa-4244
Third Party Advisory https://www.debian.org/security/2018/dsa-4235
Third Party Advisory https://usn.ubuntu.com/3714-1/
Third Party Advisory https://usn.ubuntu.com/3705-1/
Mailing List https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html
Mailing List https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2252
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2251
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2113
Third Party Advisory https://access.redhat.com/errata/RHSA-2018:2112
Third Party Advisory http://www.securitytracker.com/id/1041193
Third Party Advisory http://www.securityfocus.com/bid/104560
Third Party Advisory https://security.gentoo.org/glsa/201810-01
Third Party Advisory https://security.gentoo.org/glsa/201811-13

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* enterprise_linux_desktop == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* enterprise_linux_server == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* enterprise_linux_workstation == None == 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* enterprise_linux_desktop == None == 7.0
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* enterprise_linux_server_aus == None == 7.6
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* enterprise_linux_server == None == 7.0
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* enterprise_linux_server_eus == None == 7.5
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* enterprise_linux_server_tus == None == 7.6
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* enterprise_linux_workstation == None == 7.0
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* enterprise_linux_server_eus == None == 7.6

Vulnerable and fixed packages

Source package Branch Version Maintainer Status