CVE-2018-5146
thunderbird: An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest
CVE-2018-5146 is fixed in 8 products on 1 platform, first by thunderbird 1:52.7.0+build1-0ubuntu1, released March 15, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.1191
96th percentile
An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | thunderbird 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| thunderbird-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | thunderbird-globalmenu 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | thunderbird-gnome-support 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | thunderbird-mozsymbols 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| thunderbird-testsuite · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | thunderbird-testsuite 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | xul-ext-calendar-timezones 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | xul-ext-gdata-provider 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:52.7.0+build1-0ubuntu1 | xul-ext-lightning 1:52.7.0+build1-0ubuntu1 | Mar 15, 2018 |