Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2019-03416

Опубликовано: 09 мая 2018
Источник: fstec
CVSS3: 9.8
CVSS2: 10
EPSS Низкий

Описание

Уязвимость веб-браузеров Firefox, Firefox ESR и почтового клиента Thunderbird связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код

Вендор

Canonical Ltd.
Red Hat Inc.
Сообщество свободного программного обеспечения
Novell Inc.
Mozilla Corp.
АО «НТЦ ИТ РОСА»

Наименование ПО

Ubuntu
Red Hat Enterprise Linux
Debian GNU/Linux
OpenSUSE Leap
Firefox ESR
Suse Linux Enterprise Desktop
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
SUSE OpenStack Cloud
Suse Linux Enterprise Server
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Workstation Extension
Firefox
Thunderbird
SUSE Package Hub for SUSE Linux Enterprise
РОСА Кобальт

Версия ПО

14.04 LTS (Ubuntu)
6 (Red Hat Enterprise Linux)
7 (Red Hat Enterprise Linux)
16.04 LTS (Ubuntu)
9 (Debian GNU/Linux)
42.3 (OpenSUSE Leap)
17.10 (Ubuntu)
18.04 LTS (Ubuntu)
до 52.8 (Firefox ESR)
12 SP3 (Suse Linux Enterprise Desktop)
12 SP4 (Suse Linux Enterprise Desktop)
4 (SUSE Enterprise Storage)
12 SP2 (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-ESPOS (SUSE Linux Enterprise Server for SAP Applications)
12 SP2-LTSS (SUSE Linux Enterprise Server for SAP Applications)
12 SP3 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
12 SP3 (SUSE Linux Enterprise Software Development Kit)
12 SP4 (SUSE Linux Enterprise Software Development Kit)
7 (SUSE OpenStack Cloud)
8.0 (Debian GNU/Linux)
12 SP3 (Suse Linux Enterprise Server)
12 SP4 (Suse Linux Enterprise Server)
11 SP4 (SUSE Linux Enterprise Software Development Kit)
15.0 (OpenSUSE Leap)
15 (SUSE Linux Enterprise Module for Desktop Applications)
12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale)
15 SP1 (SUSE Linux Enterprise Module for Desktop Applications)
12 SP2-ESPOS (Suse Linux Enterprise Server)
12-LTSS (Suse Linux Enterprise Server)
12 SP1 (SUSE Linux Enterprise Server for SAP Applications)
12 SP1-LTSS (SUSE Linux Enterprise Server for SAP Applications)
12-LTSS (SUSE Linux Enterprise Server for SAP Applications)
15 (SUSE Linux Enterprise Workstation Extension)
15 SP1 (SUSE Linux Enterprise Workstation Extension)
12 SP1-LTSS (Suse Linux Enterprise Server)
12 SP2-LTSS (Suse Linux Enterprise Server)
6 (SUSE OpenStack Cloud)
до 60 (Firefox)
до 52.8 (Thunderbird)
12 (SUSE Package Hub for SUSE Linux Enterprise)
7.0 (Debian GNU/Linux)
- (РОСА Кобальт)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Canonical Ltd. Ubuntu 14.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 6
Red Hat Inc. Red Hat Enterprise Linux 7
Canonical Ltd. Ubuntu 16.04 LTS
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Novell Inc. OpenSUSE Leap 42.3
Canonical Ltd. Ubuntu 17.10
Canonical Ltd. Ubuntu 18.04 LTS
Novell Inc. Suse Linux Enterprise Desktop 12 SP3
Novell Inc. Suse Linux Enterprise Desktop 12 SP4
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2-ESPOS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP2-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP3
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4
Сообщество свободного программного обеспечения Debian GNU/Linux 8.0
Novell Inc. Suse Linux Enterprise Server 12 SP3
Novell Inc. Suse Linux Enterprise Server 12 SP4
Novell Inc. OpenSUSE Leap 15.0
Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS
Novell Inc. Suse Linux Enterprise Server 12-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP1
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP1-LTSS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP1-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS
Сообщество свободного программного обеспечения Debian GNU/Linux 7.0
АО «НТЦ ИТ РОСА» РОСА Кобальт -

Уровень опасности уязвимости

Критический уровень опасности (базовая оценка CVSS 2.0 составляет 10)
Критический уровень опасности (базовая оценка CVSS 3.0 составляет 9,8)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для программных продуктов Mozilla Corp.:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/
Для Ubuntu:
https://usn.ubuntu.com/3645-1/
https://usn.ubuntu.com/3660-1/
https://usn.ubuntu.com/3688-1/
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2018-5150/
Для Debian GNU/Linux:
https://lists.debian.org/debian-lts-announce/2018/05/msg00007.html
https://lists.debian.org/debian-lts-announce/2018/05/msg00013.html
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2018-5150
Для ОС РОСА КОБАЛЬТ:
http://wiki.rosalab.ru/ru/index.php/ROSA-SA-18-05-29.006
http://wiki.rosalab.ru/ru/index.php/ROSA-SA-18-05-29.005

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 88%
0.04116
Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Связанные уязвимости

CVSS3: 9.8
ubuntu
больше 7 лет назад

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

CVSS3: 9.8
redhat
больше 7 лет назад

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

CVSS3: 9.8
nvd
больше 7 лет назад

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

CVSS3: 9.8
debian
больше 7 лет назад

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and ...

CVSS3: 9.8
github
больше 3 лет назад

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

EPSS

Процентиль: 88%
0.04116
Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2