Vulnerabilities > CVE-2018-12375 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Memory safety bugs present in Firefox 61. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 62.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_62_0.NASL description The version of Mozilla Firefox installed on the remote macOS host is prior to 62. It is, therefore, affected by multiple vulnerabilities as noted in Mozilla Firefox stable channel update release notes for 2018/09/05. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 119748 published 2018-12-18 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119748 title Mozilla Firefox < 62 Multiple Vulnerabilities (macOS) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(119748); script_version("1.2"); script_cvs_date("Date: 2019/04/05 23:25:06"); script_cve_id( "CVE-2017-16541", "CVE-2018-12375", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12379", "CVE-2018-12381", "CVE-2018-12382", "CVE-2018-12383", "CVE-2018-18499" ); script_name(english:"Mozilla Firefox < 62 Multiple Vulnerabilities (macOS)"); script_summary(english:"Checks the version of Firefox."); script_set_attribute(attribute:"synopsis", value: "A web browser installed on the remote macOS host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Mozilla Firefox installed on the remote macOS host is prior to 62. It is, therefore, affected by multiple vulnerabilities as noted in Mozilla Firefox stable channel update release notes for 2018/09/05. Please refer to the release notes for additional information. Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number."); # https://bugzilla.mozilla.org/show_bug.cgi?id=1412081 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?eeb4654f"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1433502 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3f3e46cb"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1435319 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6f8c53b5"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1450989 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20fb56d5"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1459383 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0ba771ab"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1461027 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9999cb80"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1462693 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?63398af6"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1466577 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ec8a52cc"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1466991 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?729f9359"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1467363 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1de4cab5"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1467889 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c5d40321"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1468523 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?38d5db79"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1468738 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e15e66a"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1469309 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?71d5c763"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1469914 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0410b02e"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1470260 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c939fbe7"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1471953 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?06cc0e92"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1472925 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?635f0fa0"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1473113 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4376815f"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1473161 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?99b48daf"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1475431 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b90402bb"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1475775 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bc528cf5"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1478575 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fdfa1d66"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1478849 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d0c0acea"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1479311 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f284ef32"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1480092 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?69cce0e2"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1480517 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ae70d802"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1480521 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?dd5f0586"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1480965 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7be72ad4"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1481093 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7d6a368a"); # https://bugzilla.mozilla.org/show_bug.cgi?id=1483120 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?61040df6"); # https://bugzilla.mozilla.org/show_bug.cgi?id=894215 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9284762b"); # https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/ script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8517426b"); script_set_attribute(attribute:"solution", value: "Upgrade to Mozilla Firefox version 62 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-12376"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/09/05"); script_set_attribute(attribute:"patch_publication_date", value:"2018/09/05"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/12/18"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:firefox"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("macosx_firefox_installed.nasl"); script_require_keys("MacOSX/Firefox/Installed"); exit(0); } include("mozilla_version.inc"); kb_base = "MacOSX/Firefox"; get_kb_item_or_exit(kb_base+"/Installed"); version = get_kb_item_or_exit(kb_base+"/Version", exit_code:1); path = get_kb_item_or_exit(kb_base+"/Path", exit_code:1); if (get_kb_item(kb_base + '/is_esr')) exit(0, 'The Mozilla Firefox installation is in the ESR branch.'); mozilla_check_version(product:'firefox', version:version, path:path, esr:FALSE, fix:'62', severity:SECURITY_HOLE);NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3761-1.NASL description Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2018-12383). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 117357 published 2018-09-07 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117357 title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : firefox vulnerabilities (USN-3761-1) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-3761-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(117357); script_version("1.4"); script_cvs_date("Date: 2019/09/18 12:31:48"); script_cve_id("CVE-2018-12375", "CVE-2018-12376", "CVE-2018-12377", "CVE-2018-12378", "CVE-2018-12383"); script_xref(name:"USN", value:"3761-1"); script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : firefox vulnerabilities (USN-3761-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2018-12383). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/3761-1/" ); script_set_attribute( attribute:"solution", value:"Update the affected firefox package." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:firefox"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/10/18"); script_set_attribute(attribute:"patch_publication_date", value:"2018/09/06"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/09/07"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(14\.04|16\.04|18\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 18.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"14.04", pkgname:"firefox", pkgver:"62.0+build2-0ubuntu0.14.04.3")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"firefox", pkgver:"62.0+build2-0ubuntu0.16.04.3")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"firefox", pkgver:"62.0+build2-0ubuntu0.18.04.3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox"); }NASL family MacOS X Local Security Checks NASL id MACOS_FIREFOX_62_0_0.NASL description The version of Mozilla Firefox installed on the remote macOS or Mac OS X host is prior to 62. It is, therefore, affected by multiple critical and high severity vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 117291 published 2018-09-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117291 title Mozilla Firefox < 62 Multiple Critical Vulnerabilities (macOS) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3761-3.NASL description USN-3761-1 fixed vulnerabilities in Firefox. The update caused several regressions affecting spellchecker dictionaries and search engines, which were partially fixed by USN-3761-2. This update contains the remaining fix. We apologize for the inconvenience. Original advisory details : Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2018-12383). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 117538 published 2018-09-18 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117538 title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : firefox regressions (USN-3761-3) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_C96D416AEAE74D5DBC8440DECA9329FB.NASL description Mozilla Foundation reports : CVE-2018-12377: Use-after-free in refresh driver timers CVE-2018-12378: Use-after-free in IndexedDB CVE-2018-12379: Out-of-bounds write with malicious MAR file CVE-2017-16541: Proxy bypass using automount and autofs CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation CVE-2018-12382: Addressbar spoofing with javascript URI on Firefox for Android CVE-2018-12383: Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords CVE-2018-12375: Memory safety bugs fixed in Firefox 62 CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 last seen 2020-06-01 modified 2020-06-02 plugin id 117304 published 2018-09-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117304 title FreeBSD : mozilla -- multiple vulnerabilities (c96d416a-eae7-4d5d-bc84-40deca9329fb) NASL family Windows NASL id MOZILLA_FIREFOX_62_0_0.NASL description The version of Mozilla Firefox installed on the remote Windows host is prior to 62. It is, therefore, affected by multiple critical and high severity vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 117294 published 2018-09-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117294 title Mozilla Firefox < 62 Multiple Critical Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3761-2.NASL description USN-3761-1 fixed vulnerabilities in Firefox. The update caused several regressions affecting spellchecker dictionaries and search engines. This update fixes the problems. We apologize for the inconvenience. Original advisory details : Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-12375, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378) It was discovered that if a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2018-12383). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 117496 published 2018-09-14 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117496 title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : firefox regressions (USN-3761-2)