CVE-2018-12365: Infoleak
First published: Tue Jun 26 2018(Updated: )
A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files.
Credit: security@mozilla.org security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Linux Desktop | =6.0 | |
| Red Hat Enterprise Linux Desktop | =7.0 | |
| Red Hat Enterprise Linux Server | =6.0 | |
| Red Hat Enterprise Linux Server | =7.0 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.5 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Server | =7.6 | |
| Red Hat Enterprise Linux Workstation | =6.0 | |
| Red Hat Enterprise Linux Workstation | =7.0 | |
| Debian | =8.0 | |
| Debian | =9.0 | |
| Ubuntu | =14.04 | |
| Ubuntu | =16.04 | |
| Ubuntu | =17.10 | |
| Ubuntu | =18.04 | |
| Firefox | <61.0 | |
| Firefox | >=53.0<60.1.0 | |
| Firefox ESR | <52.9 | |
| Thunderbird | <52.9 | |
| Thunderbird | >=52.9.1<60.0 | |
| Firefox ESR | >=53.0<60.1.0 | |
| Thunderbird | <60 | 60 |
| Thunderbird | <52.9 | 52.9 |
| Firefox | <61 | 61 |
| Firefox ESR | <52.9 | 52.9 |
| Firefox ESR | <60.1 | 60.1 |
| debian/firefox | 135.0.1-1 | |
| debian/firefox-esr | 115.14.0esr-1~deb11u1 128.7.0esr-1~deb11u1 128.5.0esr-1~deb12u1 128.7.0esr-1~deb12u1 128.7.0esr-1 | |
| debian/thunderbird | 1:115.12.0-1~deb11u1 1:128.7.0esr-1~deb11u1 1:128.5.0esr-1~deb12u1 1:128.7.0esr-1~deb12u1 1:128.7.0esr-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1459206
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-19/
- https://www.mozilla.org/security/advisories/mfsa2018-15/
- https://www.mozilla.org/security/advisories/mfsa2018-16/
- https://www.mozilla.org/security/advisories/mfsa2018-17/
- https://www.mozilla.org/security/advisories/mfsa2018-18/
- https://www.mozilla.org/security/advisories/mfsa2018-19/
- https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html
- https://www.debian.org/security/2018/dsa-4235
- https://www.debian.org/security/2018/dsa-4244
- https://access.redhat.com/errata/RHSA-2018:2112
- https://access.redhat.com/errata/RHSA-2018:2113
- https://access.redhat.com/errata/RHSA-2018:2251
- https://access.redhat.com/errata/RHSA-2018:2252
- https://usn.ubuntu.com/3705-1/
- https://usn.ubuntu.com/3714-1/
- http://www.securityfocus.com/bid/104560
- http://www.securitytracker.com/id/1041193
- https://security.gentoo.org/glsa/201810-01
- https://security.gentoo.org/glsa/201811-13
- https://launchpad.net/bugs/cve/CVE-2018-12365
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/#CVE-2018-12365
- https://bugzilla.redhat.com/show_bug.cgi?id=1595030
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-16/
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12365
- https://nvd.nist.gov/vuln/detail/CVE-2018-12365
- https://security-tracker.debian.org/tracker/CVE-2018-12365
- https://ubuntu.com/security/CVE-2018-12365
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/#CVE-2018-12365
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-17/#CVE-2018-12365
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-18/#CVE-2018-12365
- https://www.mozilla.org/en-US/security/advisories/mfsa2018-19/#CVE-2018-12371
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the severity of CVE-2018-12365?
CVE-2018-12365 has been rated as a high severity vulnerability due to its potential to expose private local files.
How do I fix CVE-2018-12365?
To resolve CVE-2018-12365, users should update to the latest versions of affected software such as Thunderbird, Firefox, or Firefox ESR.
Which software is affected by CVE-2018-12365?
CVE-2018-12365 affects multiple versions of Mozilla Thunderbird, Firefox, and Firefox ESR, particularly those prior to specified versions.
What can be compromised due to CVE-2018-12365?
CVE-2018-12365 can compromise the content sandbox, allowing a malicious IPC child process to list arbitrary file names.
Is user interaction required for CVE-2018-12365 to be exploited?
No, CVE-2018-12365 can be exploited without user consent or interaction, increasing its risk.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-12365
- agent/weakness
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/description
- agent/author
- agent/references
- agent/last-modified-date
- agent/trending
- agent/source
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-cve
- collector/nvd-index
- collector/mozilla-advisory
- source/Mozilla
- agent/softwarecombine
- agent/tags
- collector/security-tracker-debian
- source/Debian
- vendor/redhat
- canonical/red hat enterprise linux desktop
- version/red hat enterprise linux desktop/6.0
- version/red hat enterprise linux desktop/7.0
- canonical/red hat enterprise linux server
- version/red hat enterprise linux server/6.0
- version/red hat enterprise linux server/7.0
- version/red hat enterprise linux server/7.6
- version/red hat enterprise linux server/7.5
- canonical/red hat enterprise linux workstation
- version/red hat enterprise linux workstation/6.0
- version/red hat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian
- version/debian/8.0
- version/debian/9.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/14.04
- version/ubuntu/16.04
- version/ubuntu/17.10
- version/ubuntu/18.04
- vendor/mozilla
- canonical/firefox
- version/firefox/53.0
- canonical/firefox esr
- canonical/thunderbird
- version/thunderbird/52.9.1
- version/firefox esr/53.0
- package-manager/debian