Bug 1557221 (CVE-2018-5146)
| Summary: | CVE-2018-5146 Mozilla: Vorbis audio processing out of bounds write (MFSA 2018-08) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | ajax, alexl, caillon, cperry, cschalle, dmoppert, erik-fedora, gecko-bugs-nobody, gecko-bugs-nobody, hdegoede, jhorak, jmagne, john.j5live, klember, mclasen, paulo.cesar.pereira.de.andrade, pjasicek, rhughes, rrelyea, rstrode, sandmann, security-response-team, sfowler, simon, stransky, tuxator, yjog, yozone |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | firefox 57.2.1, libvorbis 1.3.6 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An out of bounds write flaw was found in the processing of vorbis audio data. A maliciously crafted file or audio stream could cause the application to crash or, potentially, execute arbitrary code.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:17:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1551863, 1551864, 1551865, 1551866, 1557115, 1557116, 1557117, 1557118, 1558170, 1558171, 1558172, 1558173, 1558174, 1558175, 1558176, 1558177, 1558384, 1558385, 1558386, 1558388, 1558389, 1558390, 1558391, 1558392, 1558393, 1558394, 1558395, 1558396, 1558397, 1558398, 1558399 | ||
| Bug Blocks: | 1557112 | ||
|
Description
Huzaifa S. Sidhpurwala
2018-03-16 08:43:43 UTC
External References: https://www.mozilla.org/en-US/security/advisories/mfsa2018-08 This issue is now public via upstream advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2018-08/ *** Bug 1557113 has been marked as a duplicate of this bug. *** This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2018:0549 https://access.redhat.com/errata/RHSA-2018:0549 Created mozjs45 tracking bugs for this issue: Affects: fedora-all [bug 1558176] Created mozjs38 tracking bugs for this issue: Affects: fedora-all [bug 1558177] Created thunderbird tracking bugs for this issue: Affects: fedora-all [bug 1558173] Created mingw-libvorbis tracking bugs for this issue: Affects: fedora-all [bug 1558174] Created libvorbis tracking bugs for this issue: Affects: fedora-all [bug 1558170] Created xulrunner tracking bugs for this issue: Affects: fedora-26 [bug 1558172] Created mingw-libvorbis tracking bugs for this issue: Affects: epel-7 [bug 1558171] Created mozjs38 tracking bugs for this issue: Affects: epel-7 [bug 1558175] It appears that mozjs does not build vorbis support. Acknowledgments: Name: the Mozilla project Upstream: Richard Zhu via Trend Micro's Zero Day Initiative Upstream patch (libvorbis): https://git.xiph.org/?p=vorbis.git;a=commit;h=667ceb4aab60c1f74060143bb24e5f427b3cce5f Thunderbird 52.7 ESR includes this fix. This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0649 https://access.redhat.com/errata/RHSA-2018:0649 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:0648 https://access.redhat.com/errata/RHSA-2018:0648 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2018:0647 https://access.redhat.com/errata/RHSA-2018:0647 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2018:1058 https://access.redhat.com/errata/RHSA-2018:1058 Statement: Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. The affected code is present in esc and xulrunner, however esc has no support for audio, and xulrunner is limited to using only local content that an attacker can not control. These components are not impacted by this vulnerability. |