csaf_redhat - rhsa-2018

rhsa-2018_3006

Vulnerability from csaf_redhat

Published

2018-10-24 22:18

Modified

2024-11-22 12:20

Summary

Red Hat Security Advisory: firefox security update

Notes

Topic

An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.3.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390) * Mozilla: Crash with nested event loops (CVE-2018-12392) * Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393) * Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395) * Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396) * Mozilla: WebExtension local file permission check bypass (CVE-2018-12397) * Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond Forbes, Bogdan Tara, Nils, r, Rob Wu, Andrew Swan, and Daniel Veditz as the original reporters.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://access.redhat.com/security/updates/classification/",
         text: "Critical",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright © Red Hat, Inc. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
            title: "Topic",
         },
         {
            category: "general",
            text: "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.3.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390)\n\n* Mozilla: Crash with nested event loops (CVE-2018-12392)\n\n* Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393)\n\n* Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395)\n\n* Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396)\n\n* Mozilla: WebExtension local file permission check bypass (CVE-2018-12397)\n\n* Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nRed Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Christian Holler, Bob Owen, Boris Zbarsky, Calixte Denizet, Jason Kratzer, Jed Davis, Taegeon Lee, Philipp, Ronald Crane, Raul Gurzau, Gary Kwong, Tyson Smith, Raymond Forbes, Bogdan Tara, Nils, r, Rob Wu, Andrew Swan, and Daniel Veditz as the original reporters.",
            title: "Details",
         },
         {
            category: "legal_disclaimer",
            text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
            title: "Terms of Use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://access.redhat.com/security/team/contact/",
         issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
         name: "Red Hat Product Security",
         namespace: "https://www.redhat.com",
      },
      references: [
         {
            category: "self",
            summary: "https://access.redhat.com/errata/RHSA-2018:3006",
            url: "https://access.redhat.com/errata/RHSA-2018:3006",
         },
         {
            category: "external",
            summary: "https://access.redhat.com/security/updates/classification/#critical",
            url: "https://access.redhat.com/security/updates/classification/#critical",
         },
         {
            category: "external",
            summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/",
            url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/",
         },
         {
            category: "external",
            summary: "1642179",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642179",
         },
         {
            category: "external",
            summary: "1642180",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642180",
         },
         {
            category: "external",
            summary: "1642182",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642182",
         },
         {
            category: "external",
            summary: "1642183",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642183",
         },
         {
            category: "external",
            summary: "1642185",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642185",
         },
         {
            category: "external",
            summary: "1642186",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642186",
         },
         {
            category: "external",
            summary: "1642187",
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642187",
         },
         {
            category: "self",
            summary: "Canonical URL",
            url: "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3006.json",
         },
      ],
      title: "Red Hat Security Advisory: firefox security update",
      tracking: {
         current_release_date: "2024-11-22T12:20:19+00:00",
         generator: {
            date: "2024-11-22T12:20:19+00:00",
            engine: {
               name: "Red Hat SDEngine",
               version: "4.2.1",
            },
         },
         id: "RHSA-2018:3006",
         initial_release_date: "2018-10-24T22:18:47+00:00",
         revision_history: [
            {
               date: "2018-10-24T22:18:47+00:00",
               number: "1",
               summary: "Initial version",
            },
            {
               date: "2018-10-24T22:18:47+00:00",
               number: "2",
               summary: "Last updated version",
            },
            {
               date: "2024-11-22T12:20:19+00:00",
               number: "3",
               summary: "Last generated version",
            },
         ],
         status: "final",
         version: "3",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Desktop (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Desktop (v. 6)",
                           product_id: "6Client-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::client",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Desktop Optional (v. 6)",
                           product_id: "6Client-optional-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::client",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux HPC Node Optional (v. 6)",
                           product_id: "6ComputeNode-optional-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::computenode",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Server (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Server (v. 6)",
                           product_id: "6Server-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::server",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Server Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Server Optional (v. 6)",
                           product_id: "6Server-optional-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::server",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Workstation (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Workstation (v. 6)",
                           product_id: "6Workstation-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::workstation",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                        product: {
                           name: "Red Hat Enterprise Linux Workstation Optional (v. 6)",
                           product_id: "6Workstation-optional-6.10.z",
                           product_identification_helper: {
                              cpe: "cpe:/o:redhat:enterprise_linux:6::workstation",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "Red Hat Enterprise Linux",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                        product: {
                           name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                           product_id: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox-debuginfo@60.3.0-1.el6?arch=x86_64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "firefox-0:60.3.0-1.el6.x86_64",
                        product: {
                           name: "firefox-0:60.3.0-1.el6.x86_64",
                           product_id: "firefox-0:60.3.0-1.el6.x86_64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox@60.3.0-1.el6?arch=x86_64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "firefox-debuginfo-0:60.3.0-1.el6.i686",
                        product: {
                           name: "firefox-debuginfo-0:60.3.0-1.el6.i686",
                           product_id: "firefox-debuginfo-0:60.3.0-1.el6.i686",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox-debuginfo@60.3.0-1.el6?arch=i686",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "firefox-0:60.3.0-1.el6.i686",
                        product: {
                           name: "firefox-0:60.3.0-1.el6.i686",
                           product_id: "firefox-0:60.3.0-1.el6.i686",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox@60.3.0-1.el6?arch=i686",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i686",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "firefox-0:60.3.0-1.el6.src",
                        product: {
                           name: "firefox-0:60.3.0-1.el6.src",
                           product_id: "firefox-0:60.3.0-1.el6.src",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox@60.3.0-1.el6?arch=src",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "src",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
                        product: {
                           name: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
                           product_id: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox-debuginfo@60.3.0-1.el6?arch=s390x",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "firefox-0:60.3.0-1.el6.s390x",
                        product: {
                           name: "firefox-0:60.3.0-1.el6.s390x",
                           product_id: "firefox-0:60.3.0-1.el6.s390x",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox@60.3.0-1.el6?arch=s390x",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                        product: {
                           name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                           product_id: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox-debuginfo@60.3.0-1.el6?arch=ppc64",
                           },
                        },
                     },
                     {
                        category: "product_version",
                        name: "firefox-0:60.3.0-1.el6.ppc64",
                        product: {
                           name: "firefox-0:60.3.0-1.el6.ppc64",
                           product_id: "firefox-0:60.3.0-1.el6.ppc64",
                           product_identification_helper: {
                              purl: "pkg:rpm/redhat/firefox@60.3.0-1.el6?arch=ppc64",
                           },
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64",
               },
            ],
            category: "vendor",
            name: "Red Hat",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)",
               product_id: "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Client-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)",
               product_id: "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Client-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)",
               product_id: "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6ComputeNode-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)",
               product_id: "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Server-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)",
               product_id: "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Server-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)",
               product_id: "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Workstation-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
            },
            product_reference: "firefox-0:60.3.0-1.el6.src",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.i686",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.ppc64",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.s390x",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "firefox-debuginfo-0:60.3.0-1.el6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)",
               product_id: "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            },
            product_reference: "firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            relates_to_product_reference: "6Workstation-optional-6.10.z",
         },
      ],
   },
   vulnerabilities: [
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Daniel Veditz",
                  "Philipp",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12389",
         cwe: {
            id: "CWE-120",
            name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642179",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: Memory safety bugs fixed in Firefox ESR 60.3",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12389",
            },
            {
               category: "external",
               summary: "RHBZ#1642179",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642179",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12389",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12389",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12389",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12389",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12389",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12389",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Low",
            },
         ],
         title: "Mozilla: Memory safety bugs fixed in Firefox ESR 60.3",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Jason Kratzer",
                  "Jed Davis",
                  "Taegeon Lee",
                  "Philipp",
                  "Ronald Crane",
                  "Raul Gurzau",
                  "Gary Kwong",
                  "Tyson Smith",
                  "Raymond Forbes",
                  "Bogdan Tara",
                  "Christian Holler",
                  "Bob Owen",
                  "Boris Zbarsky",
                  "Calixte Denizet",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12390",
         cwe: {
            id: "CWE-120",
            name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642180",
            },
         ],
         notes: [
            {
               category: "description",
               text: "Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12390",
            },
            {
               category: "external",
               summary: "RHBZ#1642180",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642180",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12390",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12390",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12390",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12390",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12390",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12390",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Critical",
            },
         ],
         title: "Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Nils",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12392",
         cwe: {
            id: "CWE-364",
            name: "Signal Handler Race Condition",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642182",
            },
         ],
         notes: [
            {
               category: "description",
               text: "When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: Crash with nested event loops",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12392",
            },
            {
               category: "external",
               summary: "RHBZ#1642182",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642182",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12392",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12392",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12392",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12392",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12392",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12392",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Mozilla: Crash with nested event loops",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "R",
               ],
               organization: "Zero Day LLC",
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12393",
         cwe: {
            id: "CWE-120",
            name: "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642183",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: Integer overflow during Unicode conversion while loading JavaScript",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12393",
            },
            {
               category: "external",
               summary: "RHBZ#1642183",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642183",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12393",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12393",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12393",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12393",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12393",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12393",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Important",
            },
         ],
         title: "Mozilla: Integer overflow during Unicode conversion while loading JavaScript",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Rob Wu",
                  "Andrew Swan",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12395",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642185",
            },
         ],
         notes: [
            {
               category: "description",
               text: "By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: WebExtension bypass of domain restrictions through header rewriting",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12395",
            },
            {
               category: "external",
               summary: "RHBZ#1642185",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642185",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12395",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12395",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12395",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12395",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12395",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12395",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Mozilla: WebExtension bypass of domain restrictions through header rewriting",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Rob Wu",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12396",
         cwe: {
            id: "CWE-284",
            name: "Improper Access Control",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642186",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: WebExtension content scripts can execute in disallowed contexts",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12396",
            },
            {
               category: "external",
               summary: "RHBZ#1642186",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642186",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12396",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12396",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12396",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12396",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12396",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12396",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Mozilla: WebExtension content scripts can execute in disallowed contexts",
      },
      {
         acknowledgments: [
            {
               names: [
                  "the Mozilla project",
               ],
            },
            {
               names: [
                  "Rob Wu",
               ],
               summary: "Acknowledged by upstream.",
            },
         ],
         cve: "CVE-2018-12397",
         cwe: {
            id: "CWE-862",
            name: "Missing Authorization",
         },
         discovery_date: "2018-10-23T00:00:00+00:00",
         ids: [
            {
               system_name: "Red Hat Bugzilla ID",
               text: "1642187",
            },
         ],
         notes: [
            {
               category: "description",
               text: "A WebExtension can request access to local files without the warning prompt stating that the extension will \"Access your data for all websites\" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
               title: "Vulnerability description",
            },
            {
               category: "summary",
               text: "Mozilla: WebExtension local file permission check bypass",
               title: "Vulnerability summary",
            },
            {
               category: "general",
               text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
               title: "CVSS score applicability",
            },
         ],
         product_status: {
            fixed: [
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
               "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
               "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
            ],
         },
         references: [
            {
               category: "self",
               summary: "Canonical URL",
               url: "https://access.redhat.com/security/cve/CVE-2018-12397",
            },
            {
               category: "external",
               summary: "RHBZ#1642187",
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1642187",
            },
            {
               category: "external",
               summary: "https://www.cve.org/CVERecord?id=CVE-2018-12397",
               url: "https://www.cve.org/CVERecord?id=CVE-2018-12397",
            },
            {
               category: "external",
               summary: "https://nvd.nist.gov/vuln/detail/CVE-2018-12397",
               url: "https://nvd.nist.gov/vuln/detail/CVE-2018-12397",
            },
            {
               category: "external",
               summary: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12397",
               url: "https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12397",
            },
         ],
         release_date: "2018-10-23T00:00:00+00:00",
         remediations: [
            {
               category: "vendor_fix",
               date: "2018-10-24T22:18:47+00:00",
               details: "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.",
               product_ids: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
               restart_required: {
                  category: "none",
               },
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
         ],
         scores: [
            {
               cvss_v3: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "NONE",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Client-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Client-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6ComputeNode-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Server-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Server-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.src",
                  "6Workstation-optional-6.10.z:firefox-0:60.3.0-1.el6.x86_64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.i686",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.ppc64",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.s390x",
                  "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.3.0-1.el6.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               details: "Moderate",
            },
         ],
         title: "Mozilla: WebExtension local file permission check bypass",
      },
   ],
}

cve-2018-12395

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:30

Severity ?

Summary

By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

References

▼	URL	Tags
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK
	https://bugzilla.mozilla.org/show_bug.cgi?id=1467523	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox ESR

Version: unspecified < 60.3

Mozilla

Firefox

Version: unspecified < 63

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:30:59.771Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1467523",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "WebExtension bypass of domain restrictions through header rewriting",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1467523",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12395",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting. This would allow access to domains that share a host that are otherwise restricted. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "WebExtension bypass of domain restrictions through header rewriting",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1467523",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1467523",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12395",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:30:59.771Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12397

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:30

Severity ?

Summary

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1487478	x_refsource_CONFIRM
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox ESR

Version: unspecified < 60.3

Mozilla

Firefox

Version: unspecified < 63

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:30:59.851Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1487478",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A WebExtension can request access to local files without the warning prompt stating that the extension will \"Access your data for all websites\" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Missing warning prompt when WebExtension requests local file access",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1487478",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12397",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A WebExtension can request access to local files without the warning prompt stating that the extension will \"Access your data for all websites\" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Missing warning prompt when WebExtension requests local file access",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1487478",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1487478",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12397",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:30:59.851Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12396

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:30

Severity ?

Summary

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.

References

▼	URL	Tags
	https://bugzilla.mozilla.org/show_bug.cgi?id=1483602	x_refsource_CONFIRM
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox ESR

Version: unspecified < 60.3

Mozilla

Firefox

Version: unspecified < 63

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:30:59.819Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1483602",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "WebExtension content scripts can execute in disallowed contexts",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1483602",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12396",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR < 60.3 and Firefox < 63.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "WebExtension content scripts can execute in disallowed contexts",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1483602",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1483602",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12396",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:30:59.819Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12393

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:31

Severity ?

Summary

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105769	vdb-entry, x_refsource_BID
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-28/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/201811-13	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2018/dsa-4337	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://bugzilla.mozilla.org/show_bug.cgi?id=1495011	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://usn.ubuntu.com/3868-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3532	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3531	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox

Version: unspecified < 63

	Mozilla	Firefox ESR	Version: unspecified < 60.3
	Mozilla	Thunderbird	Version: unspecified < 60.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:31:00.111Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "105769",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105769",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  name: "GLSA-201811-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-13",
               },
               {
                  name: "DSA-4337",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4337",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1495011",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "USN-3868-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3868-1/",
               },
               {
                  name: "RHSA-2018:3532",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3532",
               },
               {
                  name: "RHSA-2018:3531",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3531",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Thunderbird",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Integer overflow during Unicode conversion while loading JavaScript",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               name: "105769",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105769",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               name: "GLSA-201811-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-13",
            },
            {
               name: "DSA-4337",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4337",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1495011",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "USN-3868-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3868-1/",
            },
            {
               name: "RHSA-2018:3532",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3532",
            },
            {
               name: "RHSA-2018:3531",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3531",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12393",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Thunderbird",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Integer overflow during Unicode conversion while loading JavaScript",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "105769",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105769",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "GLSA-201811-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-13",
                  },
                  {
                     name: "DSA-4337",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4337",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1495011",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1495011",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "USN-3868-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3868-1/",
                  },
                  {
                     name: "RHSA-2018:3532",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3532",
                  },
                  {
                     name: "RHSA-2018:3531",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3531",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12393",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:31:00.111Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12392

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:30

Severity ?

Summary

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105769	vdb-entry, x_refsource_BID
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-28/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/201811-13	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2018/dsa-4337	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1492823	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://usn.ubuntu.com/3868-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3532	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3531	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox

Version: unspecified < 63

	Mozilla	Firefox ESR	Version: unspecified < 60.3
	Mozilla	Thunderbird	Version: unspecified < 60.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:30:59.822Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "105769",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105769",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  name: "GLSA-201811-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-13",
               },
               {
                  name: "DSA-4337",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4337",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1492823",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "USN-3868-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3868-1/",
               },
               {
                  name: "RHSA-2018:3532",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3532",
               },
               {
                  name: "RHSA-2018:3531",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3531",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Thunderbird",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Crash with nested event loops",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               name: "105769",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105769",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               name: "GLSA-201811-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-13",
            },
            {
               name: "DSA-4337",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4337",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1492823",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "USN-3868-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3868-1/",
            },
            {
               name: "RHSA-2018:3532",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3532",
            },
            {
               name: "RHSA-2018:3531",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3531",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12392",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Thunderbird",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Crash with nested event loops",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "105769",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105769",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "GLSA-201811-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-13",
                  },
                  {
                     name: "DSA-4337",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4337",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1492823",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1492823",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "USN-3868-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3868-1/",
                  },
                  {
                     name: "RHSA-2018:3532",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3532",
                  },
                  {
                     name: "RHSA-2018:3531",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3531",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12392",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:30:59.822Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12389

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:31

Severity ?

Summary

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105769	vdb-entry, x_refsource_BID
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-28/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/201811-13	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2018/dsa-4337	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3868-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3532	vendor-advisory, x_refsource_REDHAT
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1498460%2C1499198	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/105723	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3531	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox ESR

Version: unspecified < 60.3

Mozilla

Thunderbird

Version: unspecified < 60.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:31:00.289Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "105769",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105769",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
               },
               {
                  name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  name: "GLSA-201811-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-13",
               },
               {
                  name: "DSA-4337",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4337",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3868-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3868-1/",
               },
               {
                  name: "RHSA-2018:3532",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3532",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1498460%2C1499198",
               },
               {
                  name: "105723",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105723",
               },
               {
                  name: "RHSA-2018:3531",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3531",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Thunderbird",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Memory safety bugs fixed in Firefox ESR 60.3",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               name: "105769",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105769",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
            },
            {
               name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               name: "GLSA-201811-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-13",
            },
            {
               name: "DSA-4337",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4337",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3868-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3868-1/",
            },
            {
               name: "RHSA-2018:3532",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3532",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1498460%2C1499198",
            },
            {
               name: "105723",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105723",
            },
            {
               name: "RHSA-2018:3531",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3531",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12389",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Thunderbird",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.3 and Thunderbird < 60.3.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Memory safety bugs fixed in Firefox ESR 60.3",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "105769",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105769",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                  },
                  {
                     name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "GLSA-201811-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-13",
                  },
                  {
                     name: "DSA-4337",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4337",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3868-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3868-1/",
                  },
                  {
                     name: "RHSA-2018:3532",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3532",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1498460%2C1499198",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1498460%2C1499198",
                  },
                  {
                     name: "105723",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105723",
                  },
                  {
                     name: "RHSA-2018:3531",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3531",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12389",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:31:00.289Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-12390

Vulnerability from cvelistv5

Published

2019-02-28 18:00

Modified

2024-08-05 08:30

Severity ?

Summary

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105769	vdb-entry, x_refsource_BID
	https://www.debian.org/security/2018/dsa-4324	vendor-advisory, x_refsource_DEBIAN
	https://www.mozilla.org/security/advisories/mfsa2018-28/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2018-26/	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/201811-04	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/201811-13	vendor-advisory, x_refsource_GENTOO
	https://www.debian.org/security/2018/dsa-4337	vendor-advisory, x_refsource_DEBIAN
	https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234%2C1496159%2C1443748%2C1496340%2C1483905%2C1493347%2C1488803%2C1498701%2C1498482%2C1442010%2C1495245%2C1483699%2C1469486%2C1484905%2C1490561%2C1492524%2C1481844	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2018-27/	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:3005	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/105718	vdb-entry, x_refsource_BID
	https://access.redhat.com/errata/RHSA-2018:3006	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3801-1/	vendor-advisory, x_refsource_UBUNTU
	https://usn.ubuntu.com/3868-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2018:3532	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:3531	vendor-advisory, x_refsource_REDHAT
	https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html	mailing-list, x_refsource_MLIST
	http://www.securitytracker.com/id/1041944	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Mozilla

Firefox

Version: unspecified < 63

	Mozilla	Firefox ESR	Version: unspecified < 60.3
	Mozilla	Thunderbird	Version: unspecified < 60.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:30:59.986Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "105769",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105769",
               },
               {
                  name: "DSA-4324",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4324",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
               },
               {
                  name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
               },
               {
                  name: "GLSA-201811-04",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-04",
               },
               {
                  name: "GLSA-201811-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201811-13",
               },
               {
                  name: "DSA-4337",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4337",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234%2C1496159%2C1443748%2C1496340%2C1483905%2C1493347%2C1488803%2C1498701%2C1498482%2C1442010%2C1495245%2C1483699%2C1469486%2C1484905%2C1490561%2C1492524%2C1481844",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
               },
               {
                  name: "RHSA-2018:3005",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3005",
               },
               {
                  name: "105718",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105718",
               },
               {
                  name: "RHSA-2018:3006",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3006",
               },
               {
                  name: "USN-3801-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3801-1/",
               },
               {
                  name: "USN-3868-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3868-1/",
               },
               {
                  name: "RHSA-2018:3532",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3532",
               },
               {
                  name: "RHSA-2018:3531",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3531",
               },
               {
                  name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
               },
               {
                  name: "1041944",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041944",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "63",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Thunderbird",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.3",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         datePublic: "2019-02-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-03-01T10:57:01",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               name: "105769",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105769",
            },
            {
               name: "DSA-4324",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4324",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
            },
            {
               name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
            },
            {
               name: "GLSA-201811-04",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-04",
            },
            {
               name: "GLSA-201811-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201811-13",
            },
            {
               name: "DSA-4337",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4337",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234%2C1496159%2C1443748%2C1496340%2C1483905%2C1493347%2C1488803%2C1498701%2C1498482%2C1442010%2C1495245%2C1483699%2C1469486%2C1484905%2C1490561%2C1492524%2C1481844",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
            },
            {
               name: "RHSA-2018:3005",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3005",
            },
            {
               name: "105718",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105718",
            },
            {
               name: "RHSA-2018:3006",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3006",
            },
            {
               name: "USN-3801-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3801-1/",
            },
            {
               name: "USN-3868-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3868-1/",
            },
            {
               name: "RHSA-2018:3532",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3532",
            },
            {
               name: "RHSA-2018:3531",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3531",
            },
            {
               name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
            },
            {
               name: "1041944",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041944",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2018-12390",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "63",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Thunderbird",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "105769",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105769",
                  },
                  {
                     name: "DSA-4324",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4324",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-28/",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-26/",
                  },
                  {
                     name: "[debian-lts-announce] 20181112 [SECURITY] [DLA 1575-1] thunderbird security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html",
                  },
                  {
                     name: "GLSA-201811-04",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-04",
                  },
                  {
                     name: "GLSA-201811-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201811-13",
                  },
                  {
                     name: "DSA-4337",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4337",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234%2C1496159%2C1443748%2C1496340%2C1483905%2C1493347%2C1488803%2C1498701%2C1498482%2C1442010%2C1495245%2C1483699%2C1469486%2C1484905%2C1490561%2C1492524%2C1481844",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1487098%2C1487660%2C1490234%2C1496159%2C1443748%2C1496340%2C1483905%2C1493347%2C1488803%2C1498701%2C1498482%2C1442010%2C1495245%2C1483699%2C1469486%2C1484905%2C1490561%2C1492524%2C1481844",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                     refsource: "CONFIRM",
                     url: "https://www.mozilla.org/security/advisories/mfsa2018-27/",
                  },
                  {
                     name: "RHSA-2018:3005",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3005",
                  },
                  {
                     name: "105718",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105718",
                  },
                  {
                     name: "RHSA-2018:3006",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3006",
                  },
                  {
                     name: "USN-3801-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3801-1/",
                  },
                  {
                     name: "USN-3868-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3868-1/",
                  },
                  {
                     name: "RHSA-2018:3532",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3532",
                  },
                  {
                     name: "RHSA-2018:3531",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3531",
                  },
                  {
                     name: "[debian-lts-announce] 20181107 [SECURITY] [DLA 1571-1] firefox-esr security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/11/msg00008.html",
                  },
                  {
                     name: "1041944",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041944",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2018-12390",
      datePublished: "2019-02-28T18:00:00",
      dateReserved: "2018-06-14T00:00:00",
      dateUpdated: "2024-08-05T08:30:59.986Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature