CVE-2018-12405

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox < 64.

• CWE-119

• http://www.securityfocus.com/bid/106168Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3831Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3833Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0159Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0160Third Party Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1494752%2C1498765%2C1503326%2C1505181%2C1500759%2C1504365%2C1506640%2C1503082%2C1502013%2C1510471Broken Link, Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00002.htmlThird Party Advisory
• https://security.gentoo.org/glsa/201903-04Third Party Advisory
• https://usn.ubuntu.com/3844-1/Third Party Advisory
• https://usn.ubuntu.com/3868-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4354Third Party Advisory
• https://www.debian.org/security/2019/dsa-4362Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-30/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-31/Vendor Advisory
• http://www.securityfocus.com/bid/106168Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:3831Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:3833Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0159Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0160Third Party Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1494752%2C1498765%2C1503326%2C1505181%2C1500759%2C1504365%2C1506640%2C1503082%2C1502013%2C1510471Broken Link, Issue Tracking, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/12/msg00002.htmlThird Party Advisory
• https://security.gentoo.org/glsa/201903-04Third Party Advisory
• https://usn.ubuntu.com/3844-1/Third Party Advisory
• https://usn.ubuntu.com/3868-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4354Third Party Advisory
• https://www.debian.org/security/2019/dsa-4362Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-29/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-30/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-31/Vendor Advisory

Published

Feb 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1240Dell EMC ViPR Controller, versions after 3.0.0.38, contain a…
• CVE-2018-12400In private browsing mode on Firefox for Android, favicons ar…
• CVE-2018-12401Some special resource URIs will cause a non-exploitable cras…
• CVE-2018-12402The internal WebBrowserPersist code does not use correct ori…
• CVE-2018-12403If a site is loaded over a HTTPS connection but loads a favi…
• CVE-2018-12404A cached side channel attack during handshakes using RSA enc…
• CVE-2018-12406Mozilla developers and community members reported memory saf…
• CVE-2018-12407A buffer overflow occurs when drawing and validating element…
• CVE-2018-12408The BusinessWorks engine component of TIBCO Software Inc.'s …7.5
• CVE-2018-12409The SOAP Admin API component of TIBCO Software Inc.'s TIBCO …
• CVE-2018-1241Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoi…
• CVE-2018-12410The web server component of TIBCO Software Inc's Spotfire St…9.8