CVE-2018-12363
Description
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2018-12363
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2018-12363.html
Vendor advisory: arch — https://security.archlinux.org/ASA-201806-14
Vendor advisory: arch — https://security.archlinux.org/ASA-201807-4
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 52.9.1-1 | |
| sles | affected | | |
| debian | sid | fixed | 61.0-1 |
| debian | bookworm | fixed | 52.9.0esr-1 |
| debian | bullseye | fixed | 52.9.0esr-1 |
| debian | forky | fixed | 52.9.0esr-1 |
| debian | trixie | fixed | 52.9.0esr-1 |
References
Verify integrity in audit chain (admin only). AS-IS.