CVE-2018-12366
firefox: An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as...
CVE-2018-12366 is fixed in 12 products on 1 platform, first by firefox 61.0+build3-0ubuntu0.18.04.1, released June 26, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0316
88th percentile
An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value. This could leak private data into the output. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 61.0+build3-0ubuntu0.18.04.1 | firefox 61.0+build3-0ubuntu0.18.04.1 | Jun 26, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 61.0+build3-0ubuntu0.18.04.1 | firefox-globalmenu 61.0+build3-0ubuntu0.18.04.1 | Jun 26, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 61.0+build3-0ubuntu0.18.04.1 | firefox-mozsymbols 61.0+build3-0ubuntu0.18.04.1 | Jun 26, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 61.0+build3-0ubuntu0.18.04.1 | firefox-testsuite 61.0+build3-0ubuntu0.18.04.1 | Jun 26, 2018 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | thunderbird 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| thunderbird-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | thunderbird-globalmenu 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | thunderbird-gnome-support 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | thunderbird-mozsymbols 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| thunderbird-testsuite · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | thunderbird-testsuite 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | xul-ext-calendar-timezones 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | xul-ext-gdata-provider 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:52.9.1+build3-0ubuntu0.18.04.1 | xul-ext-lightning 1:52.9.1+build3-0ubuntu0.18.04.1 | Jul 4, 2018 |