Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-5091: Firefox Crashes When Using WebRTC on Older Versions
CVE-2018-5091 · published 8 years ago
Summary
Using older versions of Firefox can cause the browser to crash when making voice calls or using other WebRTC features. This can leave you unable to use your browser until you restart it. Update to the latest version of Firefox to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
7.0 8.0 9.0 cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
7.3 7.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
7.3 7.4 7.5 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
| mozilla | firefox |
< 58.0 < 52.6.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
14.04 16.04 17.10 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
Original advisory text
A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 5...
A use-after-free vulnerability can occur during WebRTC connections when interacting with the DTMF timers. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Firefox < 58.
References
- http://www.securityfocus.com/bid/102783 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1040270 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:0122 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1423086 Issue Tracking Permissions Required Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/01/msg00030.html Third Party Advisory
- https://usn.ubuntu.com/3544-1/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4096 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4102 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-02/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2018-03/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-416Use After Free
Timeline
Published11 Jun 2018
Updated4 Nov 2026
First seen15 Mar 2026
Track software like this
Free during beta