CVE-2018-5147 json
The libtremor library has the same flaw as CVE-2018-5146.
published 2018-06-11 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-16933
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.4%
- EPSS 2.4% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
Patch / fix
- Mozilla Firefox ESR 52.7.2
- Mozilla Firefox 59.0.1
- firefox-esr Debian 14, Debian 13, Debian 12 52.7.2esr-1
- libvorbisidec Debian 14, Debian 13, Debian 12 1.2.1+git20180316-1
debian advisories DEBIAN-CVE-2018-5147
- firefox Ubuntu 16.04 LTS 59.0.1+build1-0ubuntu0.16.04.1
- firefox Ubuntu 18.04 LTS 59.0.1+build1-0ubuntu1
- libvorbisidec Ubuntu 14.04 LTS 1.0.2+svn18153-0.2+deb7u1build0.14.04.1
- libvorbisidec Ubuntu 16.04 LTS 1.0.2+svn18153-0.2+deb7u1build0.16.04.1
ubuntu advisories UBUNTU-CVE-2018-5147
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- MozillaFirefox SLES for SAP 11 SP4, SLES 11 SP4, SLES 11 SP3-TERADATA +3 more 52.7.3esr-72.27.2
- MozillaFirefox SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 52.7.3esr-109.25.1
suse advisories SUSE-SU-2018:0907-1SUSE-SU-2018:0850-1
- firefox-esr openSUSE Tumbleweed 128.5.1-1.1
- MozillaFirefox openSUSE Tumbleweed 92.0-1.2
opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1
Exploit prediction
2.39% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Mozilla Firefox ESR
- Mozilla Firefox
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
debian.org
/security/2018/dsa-4143
vendor-advisory, third-party-advisory
-
debian.org
/security/2018/dsa-4141
vendor-advisory, third-party-advisory
-
mozilla.org
/security/advisories/mfsa2018-08/
vendor-advisory
-
lists.debian.org
/debian-lts-announce/2018/03/msg00022.html
mailing-list, third-party-advisory
-
bugzilla.mozilla.org
/show_bug.cgi?id=1446365
issue-tracking, permissions-required
-
lists.debian.org
/debian-lts-announce/2018/03/msg00016.html
mailing-list, third-party-advisory
-
securitytracker.com
/id/1040544
vdb-entry, third-party-advisory
-
securityfocus.com
/bid/103432
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-5147
- NVD CVE-2018-5147
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.