CVE-2018-12371 Integer overflow in Firefox
An integer overflow in Skia allows attackers to trigger a crash or potentially execute code via uninitialized memory in Firefox and Thunderbird.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-12371?
CVE-2018-12371 is a high-severity vulnerability in Mozilla Firefox, published on 9 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. This results in the use of uninitialized memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 60.1, Thunderbird < 60, and Firefox < 61.
Weakness: CWE-190
Which versions are affected by CVE-2018-12371?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2018-12371?
Upgrade to a fixed version.
Is CVE-2018-12371 being exploited?
There is no known exploitation of CVE-2018-12371 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as DEBIAN-CVE-2018-12371, GHSA-jvm4-fpvm-vr72, UBUNTU-CVE-2018-12371.