CVE-2018-12361

An integer overflow can occur in the SwizzleData code while calculating buffer sizes. The overflowed value is used for subsequent graphics computations when their inputs are not sanitized which results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

• CWE-190

• http://www.securityfocus.com/bid/104558Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1463244Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2018/11/msg00011.htmlThird Party Advisory
• https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
• https://security.gentoo.org/glsa/201811-13Mitigation, Third Party Advisory
• https://usn.ubuntu.com/3705-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4295Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory
• http://www.securityfocus.com/bid/104558Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041193Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1463244Issue Tracking, Permissions Required
• https://lists.debian.org/debian-lts-announce/2018/11/msg00011.htmlThird Party Advisory
• https://security.gentoo.org/glsa/201810-01Mitigation, Third Party Advisory
• https://security.gentoo.org/glsa/201811-13Mitigation, Third Party Advisory
• https://usn.ubuntu.com/3705-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4295Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-15/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-16/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-19/Vendor Advisory

Published

Oct 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-12356An issue was discovered in password-store.sh in pass in Simp…
• CVE-2018-12357Arista CloudVision Portal through 2018.1.1 has Incorrect Per…
• CVE-2018-12358Service workers can use redirection to avoid the tainting of…
• CVE-2018-12359A buffer overflow can occur when rendering canvas content wh…
• CVE-2018-1236Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-12360A use-after-free vulnerability can occur when deleting an in…
• CVE-2018-12362An integer overflow can occur during graphics operations don…
• CVE-2018-12363A use-after-free vulnerability can occur when script uses mu…
• CVE-2018-12364NPAPI plugins, such as Adobe Flash, can send non-simple cros…
• CVE-2018-12365A compromised IPC child process can escape the content sandb…
• CVE-2018-12366An invalid grid size during QCMS (color profile) transformat…
• CVE-2018-12367In the previous mitigations for Spectre, the resolution or p…