Bug 1692732 (CVE-2018-12406)

Summary:	CVE-2018-12406 firefox: memory safety bugs showing evidence of memory corruption leading to run arbitrary code
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	0xalen+redhat, anto.trande, gecko-bugs-nobody, jhorak, john.j5live, kengert, pjasicek, rhughes, rstrode, sandmann, stransky
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	firefox 64	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-03-29 05:43:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1692767

Description msiddiqu 2019-03-26 10:22:56 UTC

Mozilla developers and community members reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 64.

Reference:
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1456947%2C1475669%2C1504816%2C1502886%2C1500064%2C1500310%2C1500696%2C1499198%2C1434490%2C1481745%2C1458129

Comment 1 msiddiqu 2019-03-26 10:26:29 UTC

External References:

https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/#CVE-2018-12406

Comment 2 Doran Moppert 2019-03-29 05:43:33 UTC

Statement:

This flaw did not affect the Firefox 60 ESR stream.