CVE-2018-5095
Publication date 23 January 2018
Last updated 24 July 2024
Ubuntu priority
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | 18.04 LTS bionic |
Fixed 59.0.1+build1-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 58.0+build6-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 58.0+build6-0ubuntu0.14.04.1
|
|
| thunderbird | 18.04 LTS bionic |
Fixed 1:52.6.0+build1-0ubuntu1
|
| 16.04 LTS xenial |
Fixed 1:52.6.0+build1-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 1:52.6.0+build1-0ubuntu0.14.04.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3529-1
- Thunderbird vulnerabilities
- 29 January 2018
- USN-3544-1
- Firefox vulnerabilities
- 24 January 2018