CVE-2018-12379 Memory corruption in Firefox
A memory corruption vulnerability in the Mozilla Updater allows attackers to trigger a crash or potentially execute code by providing a malicious MAR file.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12379?
CVE-2018-12379 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 18 Oct 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash. This requires running the Mozilla Updater manually on the local system with the malicious MAR file in order to occur. This vulnerability affects Firefox < 62, Firefox ESR < 60.2, and Thunderbird < 60.2.1.
Weakness: CWE-787
Which versions are affected by CVE-2018-12379?
It affects 9 products.
Products include Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 3 more.
How do I fix CVE-2018-12379?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-12379 being exploited?
There is no known exploitation of CVE-2018-12379 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2018-12379, GHSA-77mg-phf5-3h8g.