What’s Vulnerable › Vulnerabilities

CVE-2018-5147

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-11 · updated 2026-06-17
• Weakness: CWE-787

Description

The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.

Affected products

• Debian Linux: 7.0, 8.0, 9.0
• Mozilla Firefox: before 52.7.2; before 59.0.1 — fixed in 52.7.2, 59.0.1

How to fix

Upgrade to a fixed version: Mozilla Firefox 52.7.2, 59.0.1. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/103432
• http://www.securitytracker.com/id/1040544
• https://bugzilla.mozilla.org/show_bug.cgi?id=1446365
• https://lists.debian.org/debian-lts-announce/2018/03/msg00016.html
• https://lists.debian.org/debian-lts-announce/2018/03/msg00022.html
• https://www.debian.org/security/2018/dsa-4141
• https://www.debian.org/security/2018/dsa-4143
• https://www.mozilla.org/security/advisories/mfsa2018-08/
• http://www.securityfocus.com/bid/103432
• http://www.securitytracker.com/id/1040544
• https://bugzilla.mozilla.org/show_bug.cgi?id=1446365
• https://lists.debian.org/debian-lts-announce/2018/03/msg00016.html

Get alerted when CVE-2018-5147 or the next vulnerability affects your stack