CVE-2018-5150

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

• CWE-119

• http://www.securityfocus.com/bid/104136Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040896Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1414Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1415Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1725Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1726Third Party Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129Issue Tracking, Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/05/msg00007.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/05/msg00013.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201810-01Third Party Advisory
• https://security.gentoo.org/glsa/201811-13Third Party Advisory
• https://usn.ubuntu.com/3645-1/Third Party Advisory
• https://usn.ubuntu.com/3660-1/Third Party Advisory
• https://usn.ubuntu.com/3688-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4199Third Party Advisory
• https://www.debian.org/security/2018/dsa-4209Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-13/Vendor Advisory
• http://www.securityfocus.com/bid/104136Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040896Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1414Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1415Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1725Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:1726Third Party Advisory
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1388020%2C1433609%2C1409440%2C1448705%2C1451376%2C1452202%2C1444668%2C1393367%2C1411415%2C1426129Issue Tracking, Permissions Required, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/05/msg00007.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/05/msg00013.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201810-01Third Party Advisory
• https://security.gentoo.org/glsa/201811-13Third Party Advisory
• https://usn.ubuntu.com/3645-1/Third Party Advisory
• https://usn.ubuntu.com/3660-1/Third Party Advisory
• https://usn.ubuntu.com/3688-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4199Third Party Advisory
• https://www.debian.org/security/2018/dsa-4209Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-11/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2018-13/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5143URLs using "javascript:" have the protocol removed when past…
• CVE-2018-5144An integer overflow can occur during conversion of text to s…
• CVE-2018-5145Memory safety bugs were reported in Firefox ESR 52.6. These …
• CVE-2018-5146An out of bounds memory write while processing Vorbis audio …
• CVE-2018-5147The libtremor library has the same flaw as CVE-2018-5146. Th…
• CVE-2018-5148A use-after-free vulnerability can occur in the compositor d…
• CVE-2018-5151Memory safety bugs were reported in Firefox 59. Some of thes…
• CVE-2018-5152WebExtensions with the appropriate permissions can attach co…
• CVE-2018-5153If websocket data is sent with mixed text and binary in a si…
• CVE-2018-5154A use-after-free vulnerability can occur while enumerating a…
• CVE-2018-5155A use-after-free vulnerability can occur while adjusting lay…
• CVE-2018-5156A vulnerability can occur when capturing a media stream when…