CVE-2018-18500: Use After Free
A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 65 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 60.5 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 60.5.0-r0 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.