CVE-2018-5146

Description

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.

How to fix CVE-2018-5146

To remediate CVE-2018-5146, upgrade the affected package to a fixed version below.

Alpine/libvorbis—upgrade to 1.3.6-r0 or later
—upgrade to 52.7.2esr-1 or later
—upgrade to 52.7.2esr-1~deb7u1 or later
—upgrade to 52.7.2esr-1~deb8u1 or later
—upgrade to 1.3.5-4.2 or later
—upgrade to 1.3.4-2+deb8u1 or later
—upgrade to 1:52.7.0-1 or later

Is CVE-2018-5146 being exploited?

Likely — EPSS is 55.6%, placing CVE-2018-5146 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (7)

from 0, < 1.3.6-r0
from 0, < 52.7.2esr-1
from 0, < 52.7.2esr-1~deb7u1
from 0, < 52.7.2esr-1~deb8u1
from 0, < 1.3.5-4.2
from 0, < 1.3.4-2+deb8u1
from 0, < 1:52.7.0-1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H