CVE-2018-5096: Use After Free
A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.6 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.6 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 140.7.0esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.7.0esr-1~deb12u1Fixed in 140.4.0esr-1~deb13u1Fixed in 140.7.0esr-1~deb13u1Fixed in 140.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 52.6.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-5096?
CVE-2018-5096 is a use-after-free vulnerability that can occur while editing events in form elements on a page, resulting in a potentially exploitable crash.
Which software is affected by CVE-2018-5096?
Firefox ESR < 52.6 and Thunderbird < 52.6 are affected by CVE-2018-5096.
What is the severity of CVE-2018-5096?
CVE-2018-5096 has a severity rating of 9.8 (Critical).
What is the remedy for CVE-2018-5096?
The recommended remedy for CVE-2018-5096 is to upgrade to Firefox ESR version 52.6 or later, or Thunderbird version 52.6 or later.
Where can I find more information about CVE-2018-5096?
You can find more information about CVE-2018-5096 on the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1418922), [Mozilla Security Advisory](https://www.mozilla.org/en-US/security/advisories/mfsa2018-03/), [CVE Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5096).