CVE-2018-5095
firefox: An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with a...
CVE-2018-5095 is fixed in 12 products on 1 platform, first by thunderbird 1:52.6.0+build1-0ubuntu1, released January 22, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0413
90th percentile
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 8 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-globalmenu 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-mozsymbols 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 59.0.1+build1-0ubuntu1 | firefox-testsuite 59.0.1+build1-0ubuntu1 | Jun 11, 2018 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | thunderbird 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| thunderbird-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | thunderbird-globalmenu 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | thunderbird-gnome-support 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | thunderbird-mozsymbols 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| thunderbird-testsuite · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | thunderbird-testsuite 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | xul-ext-calendar-timezones 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | xul-ext-gdata-provider 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:52.6.0+build1-0ubuntu1 | xul-ext-lightning 1:52.6.0+build1-0ubuntu1 | Jan 22, 2018 |