CVE-2018-12378

Publication date 6 September 2018

Last updated 24 July 2024


Ubuntu priority

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored. This results in a potentially exploitable crash. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.

Status

Package Ubuntu Release Status
firefox 18.04 LTS bionic
Fixed 62.0+build2-0ubuntu0.18.04.3
16.04 LTS xenial
Fixed 62.0+build2-0ubuntu0.16.04.3
14.04 LTS trusty
Fixed 62.0+build2-0ubuntu0.14.04.3
firefox-esr 18.04 LTS bionic Not in release
16.04 LTS xenial Not in release
14.04 LTS trusty Not in release
thunderbird 18.04 LTS bionic
Fixed 1:60.2.1+build1-0ubuntu0.18.04.2
16.04 LTS xenial
Fixed 1:60.2.1+build1-0ubuntu0.16.04.4
14.04 LTS trusty
Fixed 1:60.2.1+build1-0ubuntu0.14.04.2

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H