CVE-2018-12393

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-28 · updated 2026-06-17
Weakness: CWE-190

Description

A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write. *Note: 64-bit builds are not vulnerable to this issue.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Debian Linux: 8.0, 9.0
Mozilla Firefox: before 63.0 — fixed in 63.0
Mozilla Firefox ESR: before 60.3 — fixed in 60.3
Mozilla Thunderbird: before 60.3 — fixed in 60.3
RedHat Enterprise Linux Desktop: 6.0, 7.0
RedHat Enterprise Linux Server: 6.0, 7.0
RedHat Enterprise Linux Server Aus: 7.6
RedHat Enterprise Linux Server Eus: 7.6
RedHat Enterprise Linux Server Tus: 7.6
RedHat Enterprise Linux Workstation: 6.0, 7.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 63.0; Mozilla Firefox ESR 60.3; Mozilla Thunderbird 60.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-12393 or the next vulnerability affects your stack