CVE-2018-5159
firefox: An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow chec...
CVE-2018-5159 is fixed in 12 products on 1 platform, first by firefox 60.0+build2-0ubuntu1, released May 10, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.2064
97th percentile
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| firefox · Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 | firefox 60.0+build2-0ubuntu1 | May 10, 2018 |
| firefox-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 | firefox-globalmenu 60.0+build2-0ubuntu1 | May 10, 2018 |
| firefox-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 | firefox-mozsymbols 60.0+build2-0ubuntu1 | May 10, 2018 |
| firefox-testsuite · Ubuntu 18.04.6 LTS (bionic) | 60.0+build2-0ubuntu1 | firefox-testsuite 60.0+build2-0ubuntu1 | May 10, 2018 |
| thunderbird · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | thunderbird 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| thunderbird-globalmenu · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | thunderbird-globalmenu 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| thunderbird-gnome-support · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | thunderbird-gnome-support 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| thunderbird-mozsymbols · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | thunderbird-mozsymbols 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| thunderbird-testsuite · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | thunderbird-testsuite 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| xul-ext-calendar-timezones · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | xul-ext-calendar-timezones 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| xul-ext-gdata-provider · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | xul-ext-gdata-provider 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |
| xul-ext-lightning · Ubuntu 18.04.6 LTS (bionic) | 1:52.8.0+build1-0ubuntu0.18.04.1 | xul-ext-lightning 1:52.8.0+build1-0ubuntu0.18.04.1 | May 22, 2018 |