CVE-2018-5150: Buffer Overflow
Last updated 25 August 2025
Other sources
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
— Launchpad
Mozilla developers and community members Christoph Diehl, Randell Jesup, Tyson Smith, Alex Gaynor, Ronald Crane, Julian Hector, Kannan Vijayan, and Jason Kratzer reported memory safety bugs present in Firefox 59 and Firefox ESR 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
— Mozilla
Mozilla developers and community members Christoph Diehl, Randell Jesup, Tyson Smith, Alex Gaynor, Ronald Crane, Julian Hector, Kannan Vijayan, and Jason Kratzer reported memory safety bugs present in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
— Mozilla
Mozilla developers and community members reported memory safety bugs present in Firefox 59 and Firefox ESR 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5150
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 60 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.8 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 147.0.4-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 140.7.0esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.7.0esr-1~deb12u1Fixed in 140.4.0esr-1~deb13u1Fixed in 140.7.0esr-1~deb13u1Fixed in 140.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade
Thunderbird ESRto a version that resolves this vulnerability.Fixed in 52.8
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2018-5183
- CVE-2018-5184
- CVE-2018-5154
- CVE-2018-5155
- CVE-2018-5159
- CVE-2018-5161
- CVE-2018-5162
- CVE-2018-5170
- CVE-2018-5168
- CVE-2018-5174
- CVE-2018-5178
- CVE-2018-5185
- CVE-2018-5150
- CVE-2018-5157
- CVE-2018-5158
- CVE-2018-5160
- CVE-2018-5152
- CVE-2018-5153
- CVE-2018-5163
- CVE-2018-5164
- CVE-2018-5166
- CVE-2018-5167
- CVE-2018-5169
- CVE-2018-5172
- CVE-2018-5173
- CVE-2018-5175
- CVE-2018-5176
- CVE-2018-5177
- CVE-2018-5165
- CVE-2018-5180
- CVE-2018-5181
- CVE-2018-5182
- CVE-2018-5179
- CVE-2018-5151
Frequently Asked Questions
What is the severity of CVE-2018-5150?
CVE-2018-5150 is classified as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2018-5150?
To mitigate CVE-2018-5150, update Firefox ESR to version 52.8, Thunderbird to version 52.8, or Firefox to version 60.
Which products are affected by CVE-2018-5150?
CVE-2018-5150 affects Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.
Can CVE-2018-5150 lead to memory corruption?
Yes, CVE-2018-5150 has shown evidence of memory corruption which could be exploited.
What action should users of affected software take regarding CVE-2018-5150?
Users should update their affected Mozilla products immediately to the specified remedied versions to address CVE-2018-5150.