Vulnerability Details : CVE-2018-12385
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.
Vulnerability category: Input validation
Products affected by CVE-2018-12385
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-12385
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 19 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-12385
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST | |
|
7.0
|
HIGH | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0
|
5.9
|
NIST |
CWE ids for CVE-2018-12385
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-12385
-
https://usn.ubuntu.com/3793-1/
USN-3793-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2018-25/
Security vulnerabilities fixed in Thunderbird 60.2.1 — MozillaVendor Advisory
-
https://security.gentoo.org/glsa/201811-13
Mozilla Thunderbird: Multiple vulnerabilities (GLSA 201811-13) — Gentoo securityThird Party Advisory
-
https://www.debian.org/security/2018/dsa-4327
Debian -- Security Information -- DSA-4327-1 thunderbirdThird Party Advisory
-
http://www.securitytracker.com/id/1041701
Mozilla Firefox ESR Bugs Let Users Bypass Security Restrictions and Cause the Target User's Browser to Crash - SecurityTrackerThird Party Advisory;VDB Entry
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1490585
Access DeniedIssue Tracking;Permissions Required;Vendor Advisory
-
http://www.securitytracker.com/id/1041700
Mozilla Firefox Lets Users Cause the Target User's Browser to Crash - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.mozilla.org/security/advisories/mfsa2018-22/
Security vulnerabilities fixed in Firefox 62.0.2 — MozillaVendor Advisory
-
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html
[SECURITY] [DLA 1575-1] thunderbird security updateMailing List;Third Party Advisory
-
https://security.gentoo.org/glsa/201810-01
Mozilla Firefox: Multiple vulnerabilities (GLSA 201810-01) — Gentoo securityThird Party Advisory
-
https://www.debian.org/security/2018/dsa-4304
Debian -- Security Information -- DSA-4304-1 firefox-esrThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2835
RHSA-2018:2835 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securityfocus.com/bid/105380
Mozilla Firefox and Firefox ESR CVE-2018-12385 Denial of Service VulnerabilityThird Party Advisory;VDB Entry
-
https://access.redhat.com/errata/RHSA-2018:3403
RHSA-2018:3403 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2834
RHSA-2018:2834 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:3458
RHSA-2018:3458 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://usn.ubuntu.com/3778-1/
USN-3778-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2018-23/
Security vulnerabilities fixed in Firefox ESR 60.2.1 — MozillaVendor Advisory
Jump to