CVE-2018-12385
- State
- Published
- Severity
- Not scored
- Published
- Oct 18, 2018
- Updated
- Aug 5, 2024
- Reserved
- Jun 14, 2018
Description
A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory. This issue is only exploitable in combination with another vulnerability allowing an attacker to write data into the local cache or from locally installed malware. This issue also triggers a non-exploitable startup crash for users switching between the Nightly and Release versions of Firefox if the same profile is used. This vulnerability affects Thunderbird < 60.2.1, Firefox ESR < 60.2.1, and Firefox < 62.0.2.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
ThunderbirdMozilla |
|
Firefox ESRMozilla |
|
FirefoxMozilla |
|
References
- GLSA-201810-01vendor-advisory
- 105380vdb-entry
- [debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security updatemailing-list
- GLSA-201811-13vendor-advisory
- USN-3778-1vendor-advisory
- DSA-4327vendor-advisory
- 1041700vdb-entry
- https://www.mozilla.org/security/advisories/mfsa2018-23/
- RHSA-2018:2835vendor-advisory
- RHSA-2018:3403vendor-advisory
- 1041701vdb-entry
- RHSA-2018:3458vendor-advisory
- https://www.mozilla.org/security/advisories/mfsa2018-22/
- DSA-4304vendor-advisory
- RHSA-2018:2834vendor-advisory
- USN-3793-1vendor-advisory
- https://www.mozilla.org/security/advisories/mfsa2018-25/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1490585
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.