CVE-2018-5156 Memory corruption in Firefox
A type confusion vulnerability in media stream capture can lead to a potentially exploitable crash, allowing attackers to execute arbitrary code or cause denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-5156?
CVE-2018-5156 is a critical memory corruption vulnerability in Canonical Ubuntu Linux, published on 18 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Weakness: CWE-20
Which versions are affected by CVE-2018-5156?
It affects 10 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 4 more.
How do I fix CVE-2018-5156?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2018-5156 being exploited?
There is no known exploitation of CVE-2018-5156 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2018-5156, GHSA-x98g-g264-xxpx, UBUNTU-CVE-2018-5156.