Bug 1087059 (CVE-2018-5148)

Summary:	VUL-1: CVE-2018-5148: MozillaFirefox: Use-after-free in compositor potentially allows code execution
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Petr Cerny <pcerny>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Major
Priority:	P2 - High	CC:	astieger, smash_bz, suse, wolfgang
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/202774/
Whiteboard:	CVSSv2:NVD:CVE-2018-5148:7.5:(AV:N/AC:L/Au:N/C:P/I:P/A:P) CVSSv3:NVD:CVE-2018-5148:9.8:(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVSSv3:RedHat:CVE-2018-5148:7.5:(AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv3:SUSE:CVE-2018-5148:7.5:(AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description Marcus Meissner 2018-03-27 11:42:03 UTC

rh#1560928

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.

External References:

https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1560928
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5148

Comment 1 Marcus Meissner 2018-03-27 11:42:36 UTC

Mozilla Foundation Security Advisory 2018-10
Use-after-free in compositor

Announced
    March 26, 2018
Impact
    high
Products
    Firefox, Firefox ESR
Fixed in

        Firefox 59.0.2
        Firefox ESR 52.7.3

#CVE-2018-5148: Use-after-free in compositor

Reporter
    Jesse Schwartzentruber
Impact
    high

Description

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.
References

    Bug 1440717

Comment 2 Swamp Workflow Management 2018-03-27 19:00:05 UTC

This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/591725 42.3 / MozillaFirefox

Comment 4 Swamp Workflow Management 2018-03-27 19:50:09 UTC

This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/591737 42.3 / MozillaFirefox

Comment 5 Swamp Workflow Management 2018-03-28 20:10:10 UTC

This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/592120 42.3 / MozillaFirefox

Comment 6 Swamp Workflow Management 2018-03-29 16:08:17 UTC

openSUSE-SU-2018:0843-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1087059
CVE References: CVE-2018-5148
Sources used:
openSUSE Leap 42.3 (src):    MozillaFirefox-52.7.3-86.1

Comment 7 Swamp Workflow Management 2018-03-29 19:08:01 UTC

SUSE-SU-2018:0850-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1085130,1085671,1087059
CVE References: CVE-2018-5125,CVE-2018-5127,CVE-2018-5129,CVE-2018-5130,CVE-2018-5131,CVE-2018-5144,CVE-2018-5145,CVE-2018-5146,CVE-2018-5147,CVE-2018-5148
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1

Comment 9 Swamp Workflow Management 2018-04-10 13:08:06 UTC

SUSE-SU-2018:0907-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1085130,1085671,1087059
CVE References: CVE-2018-5125,CVE-2018-5127,CVE-2018-5129,CVE-2018-5130,CVE-2018-5131,CVE-2018-5144,CVE-2018-5145,CVE-2018-5146,CVE-2018-5147,CVE-2018-5148
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Server 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    MozillaFirefox-52.7.3esr-72.27.2

Comment 10 Marcus Meissner 2019-07-18 07:20:52 UTC

released