Bug 1087059 - (CVE-2018-5148) VUL-1: CVE-2018-5148: MozillaFirefox: Use-after-free in compositor potentially allows code execution
(CVE-2018-5148)
VUL-1: CVE-2018-5148: MozillaFirefox: Use-after-free in compositor potentiall...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P2 - High : Major
: ---
Assigned To: Petr Cerny
Security Team bot
https://smash.suse.de/issue/202774/
CVSSv2:NVD:CVE-2018-5148:7.5:(AV:N/AC...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-03-27 11:42 UTC by Marcus Meissner
Modified: 2020-05-12 18:16 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2018-03-27 11:42:03 UTC
rh#1560928

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.

External References:

https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1560928
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5148
Comment 1 Marcus Meissner 2018-03-27 11:42:36 UTC
Mozilla Foundation Security Advisory 2018-10
Use-after-free in compositor

Announced
    March 26, 2018
Impact
    high
Products
    Firefox, Firefox ESR
Fixed in

        Firefox 59.0.2
        Firefox ESR 52.7.3

#CVE-2018-5148: Use-after-free in compositor

Reporter
    Jesse Schwartzentruber
Impact
    high

Description

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.
References

    Bug 1440717
Comment 2 Swamp Workflow Management 2018-03-27 19:00:05 UTC
This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/591725 42.3 / MozillaFirefox
Comment 4 Swamp Workflow Management 2018-03-27 19:50:09 UTC
This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/591737 42.3 / MozillaFirefox
Comment 5 Swamp Workflow Management 2018-03-28 20:10:10 UTC
This is an autogenerated message for OBS integration:
This bug (1087059) was mentioned in
https://build.opensuse.org/request/show/592120 42.3 / MozillaFirefox
Comment 6 Swamp Workflow Management 2018-03-29 16:08:17 UTC
openSUSE-SU-2018:0843-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 1087059
CVE References: CVE-2018-5148
Sources used:
openSUSE Leap 42.3 (src):    MozillaFirefox-52.7.3-86.1
Comment 7 Swamp Workflow Management 2018-03-29 19:08:01 UTC
SUSE-SU-2018:0850-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1085130,1085671,1087059
CVE References: CVE-2018-5125,CVE-2018-5127,CVE-2018-5129,CVE-2018-5130,CVE-2018-5131,CVE-2018-5144,CVE-2018-5145,CVE-2018-5146,CVE-2018-5147,CVE-2018-5148
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Server 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    MozillaFirefox-52.7.3esr-109.25.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    MozillaFirefox-52.7.3esr-109.25.1
Comment 9 Swamp Workflow Management 2018-04-10 13:08:06 UTC
SUSE-SU-2018:0907-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1085130,1085671,1087059
CVE References: CVE-2018-5125,CVE-2018-5127,CVE-2018-5129,CVE-2018-5130,CVE-2018-5131,CVE-2018-5144,CVE-2018-5145,CVE-2018-5146,CVE-2018-5147,CVE-2018-5148
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Server 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Point of Sale 11-SP3 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    MozillaFirefox-52.7.3esr-72.27.2
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    MozillaFirefox-52.7.3esr-72.27.2
Comment 10 Marcus Meissner 2019-07-18 07:20:52 UTC
released