CVE-2018-5187: Buffer Overflow
Last updated 25 August 2025
Other sources
Memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
— Launchpad
Mozilla developers and community members Christian Holler, Sebastian Hengst, Nils Ohlmeier, Jon Coppeard, Randell Jesup, Ted Campbell, Gary Kwong, and Jean-Yves Avenard reported memory safety bugs present in Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 61 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 147.0.4-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 60 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 60.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-5187?
CVE-2018-5187 has a high severity due to its potential to allow arbitrary code execution through memory safety vulnerabilities in affected applications.
How do I fix CVE-2018-5187?
To fix CVE-2018-5187, update affected software to the latest version, specifically Thunderbird version 60 or later and Firefox version 61 or later.
Which versions are affected by CVE-2018-5187?
CVE-2018-5187 affects Thunderbird versions prior to 60, Firefox ESR versions before 60.1, and Firefox versions prior to 61.
What products are impacted by CVE-2018-5187?
CVE-2018-5187 impacts Mozilla Thunderbird and Mozilla Firefox, specifically versions that are less than the specified fixed versions.
What are the potential exploits of CVE-2018-5187?
CVE-2018-5187 may be exploited to run arbitrary code due to the identified memory safety bugs if sufficient effort is applied by an attacker.