Bug 651676 (CVE-2018-5148)

Summary:	<www-client/firefox{,-bin}-52.7.3: vulnerability (MFSA-2018-10)
Product:	Gentoo Security	Reporter:	Alexander Sergeyev <sergeev917>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	mozilla
Priority:	Normal	Keywords:	STABLEREQ
Version:	unspecified	Flags:	stable-bot: sanity-check+
Hardware:	All
OS:	Linux
URL:	https://www.mozilla.org/en-US/security/advisories/mfsa2018-10
Whiteboard:
Package list:	=www-client/firefox-52.8.0	Runtime testing required:	---

Description Alexander Sergeyev 2018-03-27 08:14:51 UTC

Fixed in Firefox 59.0.2, Firefox ESR 52.7.3.

CVE-2018-5148: Use-after-free in compositor

Impact high

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.

Comment 1 Ian Stakenvicius (RETIRED) gentoo-dev

2018-05-11 16:07:29 UTC

Since this was never stabilized, please stabilize www-client/firefox-52.8.0 to address this as well as newer security bugs.

Comment 2 Thomas Deutschmann (RETIRED) gentoo-dev

2018-05-13 22:08:00 UTC

x86 stable

Comment 3 Aaron Bauman (RETIRED) gentoo-dev

2018-05-13 23:45:59 UTC

amd64 stable