Bug 1692663 (CVE-2018-12388)

Summary: CVE-2018-12388 firefox: memory safety bugs showing evidence of memory corruption leading to run arbitrary code
Product: [Other] Security Response Reporter: msiddiqu
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: 0xalen+redhat, anto.trande, gecko-bugs-nobody, jhorak, john.j5live, kengert, pjasicek, rhughes, rstrode, sandmann, stransky
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: firefox 63 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-04-01 02:08:19 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1692382    

Description msiddiqu 2019-03-26 07:53:02 UTC
Mozilla developers and community members reported memory safety bugs present in Firefox 62. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63.

References:
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1472639
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1485698
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1301547
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1471427
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1379411
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1482122
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1486314
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487167

Comment 2 Doran Moppert 2019-03-29 05:44:07 UTC
Statement:

This flaw did not affect the Firefox 60 ESR stream.