CVE-2018-12360
Estado: ModificadaAlta (8.8)—
A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
CVSS
- Versión: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 3.11%
- Percentil entre todas las CVEs puntuadas: 87
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (11)
Canonical — Ubuntu LinuxDebian — Debian LinuxMozilla — FirefoxMozilla — Firefox ESRMozilla — ThunderbirdRedhat — Enterprise Linux DesktopRedhat — Enterprise Linux ServerRedhat — Enterprise Linux Server AUSRedhat — Enterprise Linux Server EUSRedhat — Enterprise Linux Server TUSRedhat — Enterprise Linux Workstation
CWE
- CWE-416
Referencias
- http://www.securityfocus.com/bid/104555
- http://www.securitytracker.com/id/1041193
- https://access.redhat.com/errata/RHSA-2018:2112
- https://access.redhat.com/errata/RHSA-2018:2113
- https://access.redhat.com/errata/RHSA-2018:2251
- https://access.redhat.com/errata/RHSA-2018:2252
- https://bugzilla.mozilla.org/show_bug.cgi?id=1459693
- https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html
- https://security.gentoo.org/glsa/201810-01
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3705-1/
- https://usn.ubuntu.com/3714-1/
- https://www.debian.org/security/2018/dsa-4235
- https://www.debian.org/security/2018/dsa-4244
- https://www.mozilla.org/security/advisories/mfsa2018-15/
- https://www.mozilla.org/security/advisories/mfsa2018-16/
- https://www.mozilla.org/security/advisories/mfsa2018-17/
- https://www.mozilla.org/security/advisories/mfsa2018-18/
- https://www.mozilla.org/security/advisories/mfsa2018-19/
- http://www.securityfocus.com/bid/104555
- http://www.securitytracker.com/id/1041193
- https://access.redhat.com/errata/RHSA-2018:2112
- https://access.redhat.com/errata/RHSA-2018:2113
- https://access.redhat.com/errata/RHSA-2018:2251
- https://access.redhat.com/errata/RHSA-2018:2252
- https://bugzilla.mozilla.org/show_bug.cgi?id=1459693
- https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html
- https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html
- https://security.gentoo.org/glsa/201810-01
- https://security.gentoo.org/glsa/201811-13
- https://usn.ubuntu.com/3705-1/
- https://usn.ubuntu.com/3714-1/
- https://www.debian.org/security/2018/dsa-4235
- https://www.debian.org/security/2018/dsa-4244
- https://www.mozilla.org/security/advisories/mfsa2018-15/
- https://www.mozilla.org/security/advisories/mfsa2018-16/
- https://www.mozilla.org/security/advisories/mfsa2018-17/
- https://www.mozilla.org/security/advisories/mfsa2018-18/
- https://www.mozilla.org/security/advisories/mfsa2018-19/
JSON original (NVD)
Mostrar
{
"id": "CVE-2018-12360",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security@mozilla.org",
"affectedData": [
{
"vendor": "Mozilla",
"product": "Thunderbird",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "60",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "52.9",
"versionType": "custom"
}
]
},
{
"vendor": "Mozilla",
"product": "Firefox ESR",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "60.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "unspecified",
"lessThan": "52.9",
"versionType": "custom"
}
]
},
{
"vendor": "Mozilla",
"product": "Firefox",
"versions": [
{
"status": "affected",
"version": "unspecified",
"lessThan": "61",
"versionType": "custom"
}
]
}
]
}
],
"published": "2018-10-18T13:29:00.853",
"references": [
{
"url": "http://www.securityfocus.com/bid/104555",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@mozilla.org"
},
{
"url": "http://www.securitytracker.com/id/1041193",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "security@mozilla.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2112",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2113",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2251",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2252",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1459693",
"tags": [
"Issue Tracking",
"Permissions Required",
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://security.gentoo.org/glsa/201810-01",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://security.gentoo.org/glsa/201811-13",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://usn.ubuntu.com/3705-1/",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://usn.ubuntu.com/3714-1/",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.debian.org/security/2018/dsa-4235",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.debian.org/security/2018/dsa-4244",
"tags": [
"Third Party Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-15/",
"tags": [
"Vendor Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-16/",
"tags": [
"Vendor Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-17/",
"tags": [
"Vendor Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-18/",
"tags": [
"Vendor Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-19/",
"tags": [
"Vendor Advisory"
],
"source": "security@mozilla.org"
},
{
"url": "http://www.securityfocus.com/bid/104555",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1041193",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2112",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2113",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2251",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2018:2252",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1459693",
"tags": [
"Issue Tracking",
"Permissions Required",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00013.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201810-01",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201811-13",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/3705-1/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://usn.ubuntu.com/3714-1/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2018/dsa-4235",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.debian.org/security/2018/dsa-4244",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-15/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-16/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-17/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-18/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2018-19/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-416"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61."
},
{
"lang": "es",
"value": "Puede ocurrir una vulnerabilidad de uso de memoria previamente liberada al eliminar un elemento input durante un manejador de eventos de mutación que se desencadena al focalizar dicho elemento. Esto resulta en un cierre inesperado potencialmente explotable. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 60 y la 52.9, Firefox ESR en versiones anteriores a la 60.1 y la 52.9 y Firefox en versiones anteriores a la 61."
}
],
"lastModified": "2026-06-17T01:37:36.650",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4E9DD8A-A68B-4A69-8B01-BFF92A2020A8"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF77CDCF-B9C9-427D-B2BF-36650FB2148C"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9070C9D8-A14A-467F-8253-33B966C16886"
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2F47E7EA-86AF-46A8-8E17-3360A8AE8492",
"versionEndExcluding": "61.0"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C3B8C21C-B987-4585-BE32-7D9CB9FC1C24",
"versionEndExcluding": "60.1.0",
"versionStartIncluding": "53.0"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A6C8C7E3-CDC4-4C30-A98D-CC55BF72A404",
"versionEndExcluding": "52.9"
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8131415-A73C-42F1-BB3E-E5F09CDD7FC4",
"versionEndExcluding": "52.9"
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C153A53-86A9-4EE3-8F40-733F844F371F",
"versionEndExcluding": "60.0",
"versionStartIncluding": "52.9.1"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security@mozilla.org"
}