NetSight
IP …
critical9.8Public exploit code

CVE-2018-5159

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds wr…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Affected products

VendorProductAffected versions
DebianDebian Linux
Versions 7.0, 8.0, 9.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Version 7.6
RedhatEnterprise Linux Server Eus
Versions 7.5, 7.6
RedhatEnterprise Linux Server Tus
Version 7.6
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
MozillaFirefox
before 52.8.0
before 60.0
MozillaThunderbird
before 52.8.0
MozillaThunderbird Esr
before 52.8.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 17.10, 18.04

Weakness classification

CWE-190CWE-787

References