CVE-2018-12361

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

Link	Resource
https://www.mozilla.org/security/advisories/mfsa2018-19/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1463244	Issue Tracking Permissions Required
https://www.debian.org/security/2018/dsa-4295	Third Party Advisory
https://usn.ubuntu.com/3705-1/	Third Party Advisory
http://www.securitytracker.com/id/1041193	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/104558	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201810-01	Mitigation Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	Third Party Advisory
https://security.gentoo.org/glsa/201811-13	Mitigation Third Party Advisory

Configuration 1

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

---

Published : 2018-10-18 01:29

Updated : 2018-12-06 02:38

---

NVD link : CVE-2018-12361

Mitre link : CVE-2018-12361

No products.

CWE-190