CVE-2018-5129: High severity Mozilla Thunderbird vulnerability
A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages. This can potentially allow for sandbox escape through memory corruption in the parent process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 59 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.7 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 147.0.4-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 140.7.0esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.7.0esr-1~deb12u1Fixed in 140.4.0esr-1~deb13u1Fixed in 140.7.0esr-1~deb13u1Fixed in 140.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-5129?
The severity of CVE-2018-5129 is high with a CVSS score of 8.6.
Which software is affected by CVE-2018-5129?
CVE-2018-5129 affects Thunderbird < 52.7, Firefox ESR < 52.7, and Firefox < 59.
How does CVE-2018-5129 exploit work?
CVE-2018-5129 exploits a lack of parameter validation on IPC messages, allowing a potential out-of-bounds write through malformed IPC messages.
Can CVE-2018-5129 lead to sandbox escape?
Yes, CVE-2018-5129 can potentially allow for sandbox escape through memory corruption in the parent process.
How can I mitigate CVE-2018-5129 vulnerability?
To mitigate CVE-2018-5129, make sure to update Thunderbird to version 52.7 or higher, Firefox ESR to version 52.7 or higher, and Firefox to version 59 or higher.