Vulnerability CVE-2018-12365: Information

Description

A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction. This could result in exposure of private local files. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-12365
Published: Oct. 18, 2018
Modified: Dec. 3, 2018
Error type identifier: CWE-200

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus61.0-alt1127.0-alt1ALT-PU-2018-1985-1209471Fixed
firefoxp1061.0-alt1118.0.2-alt0.p10.1ALT-PU-2018-1985-1209471Fixed
firefoxp961.0-alt1105.0.1-alt0.c9.1ALT-PU-2018-1985-1209471Fixed
firefoxp861.0.1-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2018-2036-1209591Fixed
firefoxc10f161.0-alt1112.0.2-alt0.p10.1ALT-PU-2018-1985-1209471Fixed
firefoxc9f261.0-alt1105.0.1-alt0.c9.1ALT-PU-2018-1985-1209471Fixed
firefoxc760.6.1-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-1726-1218597Fixed
firefoxp1161.0-alt1126.0.1-alt1ALT-PU-2018-1985-1209471Fixed
firefox-esrsisyphus60.1.0-alt1115.11.0-alt1ALT-PU-2018-1952-1209186Fixed
firefox-esrp1060.1.0-alt1115.11.0-alt1ALT-PU-2018-1952-1209186Fixed
firefox-esrp968.0.2-alt1102.11.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp860.1.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2018-1966-1207865Fixed
firefox-esrc10f160.1.0-alt1115.9.1-alt0.c10.1ALT-PU-2018-1952-1209186Fixed
firefox-esrc9f268.0.2-alt1102.12.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp1160.1.0-alt1115.11.0-alt1ALT-PU-2018-1952-1209186Fixed
thunderbirdsisyphus52.9.0-alt1115.9.0-alt1ALT-PU-2018-1978-1209483Fixed
thunderbirdp1052.9.0-alt1115.9.0-alt1ALT-PU-2018-1978-1209483Fixed
thunderbirdp952.9.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1978-1209483Fixed
thunderbirdp852.9.0-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2018-1988-1209501Fixed
thunderbirdc10f152.9.0-alt1115.9.0-alt0.c10.1ALT-PU-2018-1978-1209483Fixed
thunderbirdc9f252.9.0-alt1102.11.0-alt0.c9.1ALT-PU-2018-1978-1209483Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed
thunderbirdp1152.9.0-alt1115.9.0-alt1ALT-PU-2018-1978-1209483Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2018-19/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-18/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-17/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1459206
  • Issue Tracking
  • Permissions Required
  • Vendor Advisory
DSA-4244
  • Third Party Advisory
DSA-4235
  • Third Party Advisory
USN-3714-1
  • Third Party Advisory
USN-3705-1
  • Third Party Advisory
[debian-lts-announce] 20180714 [SECURITY] [DLA 1425-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20180629 [SECURITY] [DLA 1406-1] firefox-esr security update
  • Mailing List
  • Third Party Advisory
RHSA-2018:2252
  • Third Party Advisory
RHSA-2018:2251
  • Third Party Advisory
RHSA-2018:2113
  • Third Party Advisory
RHSA-2018:2112
  • Third Party Advisory
1041193
  • Third Party Advisory
  • VDB Entry
104560
  • Third Party Advisory
  • VDB Entry
GLSA-201810-01
  • Third Party Advisory
GLSA-201811-13
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
      cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

      Configuration 4

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      61.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      52.9
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      52.9
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      Start including
      53.0
      End excliding
      60.1.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      Start including
      52.9.1
      End excliding
      60.0
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top