Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-18500: Firefox, Firefox ESR, and Thunderbird may crash when processing HTML

CVE-2018-18500 · published 7 years ago

Summary

When these browsers read web pages that use custom HTML elements, they can mistakenly release memory that is still needed, causing the program to crash. The bug exists in older versions of Firefox (before 65), Firefox ESR (before 60.5) and Thunderbird (before 60.5). Update to the latest browser releases or install the latest security updates from your Linux distribution to protect against this issue.

What to do

Update mozilla firefox to version 65.0 or later.
Update mozilla firefox_esr to version 60.5 or later.
Update mozilla thunderbird to version 60.5 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	< 65.0 `cpe:2.3:a:mozilla:firefox::::::::`
mozilla	firefox_esr	< 60.5 `cpe:2.3:a:mozilla:firefox_esr::::::::`
mozilla	thunderbird	< 60.5 `cpe:2.3:a:mozilla:thunderbird::::::::`
canonical	ubuntu_linux	14.04 16.04 18.04 18.10 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::`
debian	debian_linux	8.0 9.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
redhat	enterprise_linux_desktop	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_server_aus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*`
redhat	enterprise_linux_server_eus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:::::::*`
redhat	enterprise_linux_server_tus	7.6 `cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*`
redhat	enterprise_linux_workstation	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`

Original advisory text

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

References

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00021.html
http://www.securityfocus.com/bid/106781 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2019:0218 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0219 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0269 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0270 Third Party Advisory
https://security.gentoo.org/glsa/201904-07
https://lists.debian.org/debian-lts-announce/2019/01/msg00025.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/02/msg00024.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201903-04 Third Party Advisory
https://usn.ubuntu.com/3874-1/ Third Party Advisory
https://usn.ubuntu.com/3897-1/ Third Party Advisory
https://www.debian.org/security/2019/dsa-4376 Third Party Advisory
https://www.debian.org/security/2019/dsa-4392 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-01/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-02/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-03/ Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

13% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published5 Feb 2019

Updated20 Oct 2026

First seen29 Sep 2026

Sources

CVE-2018-18500 · NVD

Track software like this

Free during beta