CVE-2018-12387: Input Validation
A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12387?
CVE-2018-12387 has been classified as a high severity vulnerability.
How do I fix CVE-2018-12387?
To fix CVE-2018-12387, update Firefox to version 62.0.3 or later, or to corresponding patched versions of Firefox ESR and affected distributions.
Which software is affected by CVE-2018-12387?
CVE-2018-12387 affects Mozilla Firefox versions up to 62.0.3 and Firefox ESR up to 60.2.2, as well as several versions of Red Hat Enterprise Linux and Debian.
Can CVE-2018-12387 be exploited remotely?
Yes, CVE-2018-12387 can potentially be exploited remotely through malicious JavaScript code.
What is the impact of CVE-2018-12387 if exploited?
Exploitation of CVE-2018-12387 could lead to memory address leaks and potentially allow for further exploitation within sandboxed content.