Every CVE Search/ Get API key

CVE-2018-5096

A use-after-free vulnerability can occur while editing events in form elements on a page,...

9.8 CriticalFix available

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.85%Up 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
CVE-2018-5096
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
CVE-2018-5096
Updated
2026-11-02
EUVDEUVD-2018-16882 No score

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
EUVD-2018-16882
Updated
2026-11-03
GitHub AdvisoriesGHSA-22wm-h2wq-6vm3 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page,...

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
GHSA-22wm-h2wq-6vm3
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVALPINE-CVE-2018-5096 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
ALPINE-CVE-2018-5096
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
CVE-2018-5096
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2018-5096 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
DEBIAN-CVE-2018-5096
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:0122 9.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2018:0122
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:0262 9.8

Red Hat Security Advisory: thunderbird security update

Record
RHSA-2018:0262
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-5096 9.8

A use-after-free vulnerability can occur while editing events in form elements on a page, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.6 and Thunderbird < 52.6.

Record
UBUNTU-CVE-2018-5096
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0097 No score

Updated firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117).

To mitigate timing-based side-channel attacks similar to "Spectre" and "Meltdown", the resolution of performance.now() has been reduced from 5μs to 20μs.

Record
MGASA-2018-0097
Updated
2026-11-02
OSVMGASA-2018-0099 No score

Updated firefox packages fix security vulnerabilities

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117).

To mitigate timing-based side-channel attacks similar to "Spectre" and "Meltdown", the resolution of performance.now() has been reduced from 5μs to 20μs.

Record
MGASA-2018-0099
Updated
2026-11-02
OSVMGASA-2018-0115 No score

Updated thunderbird packages fix security vulnerability

Integer overflow in Skia library during edge builder allocation. (CVE-2018-5095)

Use-after-free while editing form elements. (CVE-2018-5096)

Use-after-free when source document is manipulated during XSLT. (CVE-2018-5097)

Use-after-free while manipulating form input elements. (CVE-2018-5098)

Use-after-free with widget listener. (CVE-2018-5099)

Use-after-free in HTML media elements. (CVE-2018-5102)

Use-after-free during mouse event handling. (CVE-2018-5103)

Use-after-free during font face manipulation. (CVE-2018-5104)

URL spoofing with right-to-left text aligned left-to-right. (CVE-2018-5117)

Memory safety bugs fixed in Firefox 58, Firefox ESR 52.6, and Thunderbird 52.6. (CVE-2018-5089)

Record
MGASA-2018-0115
Updated
2026-11-02
OSVMGASA-2018-0338 No score

Updated iceaepe packages fix security vulnerability

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.49.1 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117, CVE-2018-5125, CVE-2018-5127, CVE-2018-5129, CVE-2018-5130, CVE-2018-5131, CVE-2018-5144, CVE-2018-5145, CVE-2018-5148, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178, CVE-2018-5183, CVE-2018-6126)

Record
MGASA-2018-0338
Updated
2026-11-02
OSVopenSUSE-SU-2018:0256-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 52.6 fixes several issues.

These security issues were fixed:

  • CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
  • CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
  • CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
  • CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
  • CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
  • CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
  • CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
  • CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
  • CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
  • CVE-2018-5089: Various memory safety bugs (bsc#1077291).

These security issues were fixed:

  • Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found.
  • Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices
  • Calendar: Unintended task deletion if numlock is enabled
Record
openSUSE-SU-2018:0256-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:0257-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird to version 52.6 fixes several issues.

These security issues were fixed:

  • CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
  • CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
  • CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
  • CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
  • CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
  • CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
  • CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
  • CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
  • CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
  • CVE-2018-5089: Various memory safety bugs (bsc#1077291).

These security issues were fixed:

  • Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found.
  • Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices
  • Calendar: Unintended task deletion if numlock is enabled
Record
openSUSE-SU-2018:0257-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVSUSE-SU-2018:0361-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to version ESR 52.6 fixes several issues.

These security issues were fixed:

  • CVE-2018-5091: Use-after-free with DTMF timers (bsc#1077291).
  • CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
  • CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
  • CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
  • CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
  • CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
  • CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
  • CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
  • CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
  • CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
  • CVE-2018-5089: Various memory safety bugs (bsc#1077291).
Record
SUSE-SU-2018:0361-1
Updated
2026-11-02
OSVSUSE-SU-2018:0374-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox to version 52.6 several issues.

These security issues were fixed:

  • CVE-2018-5091: Use-after-free with DTMF timers (bsc#1077291).
  • CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
  • CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
  • CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
  • CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
  • CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
  • CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
  • CVE-2018-5089: Fixed several memory safety bugs (bsc#1077291).
  • CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
  • CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
  • CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
Record
SUSE-SU-2018:0374-1
Updated
2026-11-02
OSVUSN-3529-1 No score

thunderbird vulnerabilities

It was discovered that a From address encoded with a null character is cut off in the message header display. An attacker could potentially exploit this to spoof the sender address. (CVE-2017-7829)

It was discovered that it is possible to execute JavaScript in RSS feeds in some circumstances. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this in combination with another vulnerability, in order to cause unspecified problems. (CVE-2017-7846)

It was discovered that the RSS feed can leak local path names. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this to obtain sensitive information. (CVE-2017-7847)

It was discovered that RSS feeds are vulnerable to new line injection. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this to cause unspecified problems. (CVE-2017-7848)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, execute arbitrary code, or cause other unspecified effects. (CVE-2018-5089, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117)

Record
USN-3529-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.10
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.11
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.12
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.13
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.14
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.15
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.16
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.17
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.18
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.19
 before 52.6.0-r0
52.6.0-r0
Show 85 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.20
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.21
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.22
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.23
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.7
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.8
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Alpine:v3.9
 before 52.6.0-r0
52.6.0-r0
firefox-esr
Debian:12
 before 52.6.0esr-1
52.6.0esr-1
firefox-esr
Debian:13
 before 52.6.0esr-1
52.6.0esr-1
firefox-esr
Debian:14
 before 52.6.0esr-1
52.6.0esr-1
thunderbird
Debian:12
 before 1:52.6.0-1
1:52.6.0-1
thunderbird
Debian:13
 before 1:52.6.0-1
1:52.6.0-1
thunderbird
Debian:14
 before 1:52.6.0-1
1:52.6.0-1
firefox-esr
Debian:7
From an advisory covering 11 CVEs
 before 52.6.0esr-1~deb7u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
52.6.0esr-1~deb7u1
thunderbird
Debian:7
From an advisory covering 10 CVEs
 before 1:52.6.0-1~deb7u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 19 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u1
1:52.6.0-1~deb7u1
firefox-esr
Debian:8
From an advisory covering 11 CVEs
 before 52.6.0esr-1~deb8u1, plus listed versions
45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1
Show 45 moreShow less
45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1
52.6.0esr-1~deb8u1
firefox-esr
Debian:9
From an advisory covering 11 CVEs
 before 52.6.0esr-1~deb9u1, plus listed versions
45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1
Show 26 moreShow less
52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u1
52.6.0esr-1~deb9u1
thunderbird
Debian:8
From an advisory covering 10 CVEs
 before 1:52.6.0-1~deb8u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 20 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-1~deb7u1
1:52.6.0-1~deb8u1
thunderbird
Debian:9
From an advisory covering 10 CVEs
 before 1:52.6.0-1~deb9u1, plus listed versions
1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1
Show 21 moreShow less
1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-1~deb7u11:52.6.0-1~deb8u1
1:52.6.0-1~deb9u1
nspr
Mageia:6
From an advisory covering 11 CVEs
 before 4.18-1.mga6
4.18-1.mga6
rootcerts
Mageia:6
From an advisory covering 11 CVEs
 before 20180104.00-1.mga6
20180104.00-1.mga6
nss
Mageia:6
From an advisory covering 11 CVEs
 before 3.28.6-1.3.mga6
3.28.6-1.3.mga6
firefox
Mageia:6
From an advisory covering 11 CVEs
 before 52.6.0-1.mga6
52.6.0-1.mga6
firefox-l10n
Mageia:6
From an advisory covering 11 CVEs
 before 52.6.0-1.mga6
52.6.0-1.mga6
nspr
Mageia:5
From an advisory covering 11 CVEs
 before 4.18-1.mga5
4.18-1.mga5
rootcerts
Mageia:5
From an advisory covering 11 CVEs
 before 20180104.00-1.mga5
20180104.00-1.mga5
nss
Mageia:5
From an advisory covering 11 CVEs
 before 3.28.6-1.3.mga5
3.28.6-1.3.mga5
firefox
Mageia:5
From an advisory covering 11 CVEs
 before 52.6.0-1.mga5
52.6.0-1.mga5
firefox-l10n
Mageia:5
From an advisory covering 11 CVEs
 before 52.6.0-1.mga5
52.6.0-1.mga5
thunderbird
Mageia:5
From an advisory covering 10 CVEs
 before 52.6.0-1.mga5
52.6.0-1.mga5
thunderbird-l10n
Mageia:5
From an advisory covering 10 CVEs
 before 52.6.0-1.mga5
52.6.0-1.mga5
thunderbird
Mageia:6
From an advisory covering 10 CVEs
 before 52.6.0-1.mga6
52.6.0-1.mga6
thunderbird-l10n
Mageia:6
From an advisory covering 10 CVEs
 before 52.6.0-1.mga6
52.6.0-1.mga6
iceape
Mageia:6
From an advisory covering 29 CVEs
 before 2.49.3-1.mga6
2.49.3-1.mga6
firefox
Red Hat:enterprise_linux:6::client
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox
Red Hat:enterprise_linux:6::computenode
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox
Red Hat:enterprise_linux:6::server
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox
Red Hat:enterprise_linux:6::workstation
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
firefox
Red Hat:enterprise_linux:7::client
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
firefox-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
firefox
Red Hat:enterprise_linux:7::server
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
firefox-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
firefox
Red Hat:enterprise_linux:7::workstation
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
firefox-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 11 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el6_9
0:52.6.0-1.el6_9
thunderbird
Red Hat:enterprise_linux:7::client
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird-debuginfo
Red Hat:enterprise_linux:7::client
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird-debuginfo
Red Hat:enterprise_linux:7::server
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird
Red Hat:enterprise_linux:7::workstation
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
thunderbird-debuginfo
Red Hat:enterprise_linux:7::workstation
From an advisory covering 10 CVEs
 before 0:52.6.0-1.el7_4
0:52.6.0-1.el7_4
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP3-TERADATA
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 11 CVEs
 before 52.6.0esr-72.20.2
52.6.0esr-72.20.2
MozillaFirefox
SUSE:OpenStack Cloud 6
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 11 CVEs
 before 52.6.0esr-109.13.1
52.6.0esr-109.13.1
thunderbird
Ubuntu:14.04:LTS
 before 1:52.6.0+build1-0ubuntu0.14.04.1, plus listed versions
1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1
Show 31 moreShow less
1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.11:31.1.1+build1-0ubuntu0.14.04.11:31.1.2+build1-0ubuntu0.14.04.11:31.2.0+build2-0ubuntu0.14.04.11:31.3.0+build1-0ubuntu0.14.04.11:31.4.0+build1-0ubuntu0.14.04.11:31.5.0+build1-0ubuntu0.14.04.11:31.6.0+build1-0ubuntu0.14.04.11:31.7.0+build1-0ubuntu0.14.04.11:31.8.0+build1-0ubuntu0.14.04.11:38.2.0+build1-0ubuntu0.14.04.11:38.3.0+build1-0ubuntu0.14.04.11:38.4.0+build3-0ubuntu0.14.04.11:38.5.1+build2-0ubuntu0.14.04.11:38.6.0+build1-0ubuntu0.14.04.11:38.7.2+build1-0ubuntu0.14.04.11:38.8.0+build1-0ubuntu0.14.04.11:45.2.0+build1-0ubuntu0.14.04.31:45.3.0+build1-0ubuntu0.14.04.41:45.4.0+build1-0ubuntu0.14.04.11:45.5.1+build1-0ubuntu0.14.04.11:45.7.0+build1-0ubuntu0.14.04.11:45.8.0+build1-0ubuntu0.14.04.11:52.1.1+build1-0ubuntu0.14.04.11:52.2.1+build1-0ubuntu0.14.04.11:52.3.0+build1-0ubuntu0.14.04.11:52.4.0+build1-0ubuntu0.14.04.21:52.5.0+build1-0ubuntu0.14.04.1
1:52.6.0+build1-0ubuntu0.14.04.1
thunderbird
Ubuntu:16.04:LTS
 before 1:52.6.0+build1-0ubuntu0.16.04.1, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 11 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.1
1:52.6.0+build1-0ubuntu0.16.04.1
thunderbird
Ubuntu:14.04:LTS
From an advisory covering 14 CVEs
 before 1:52.6.0+build1-0ubuntu0.14.04.1, plus listed versions
1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1
Show 31 moreShow less
1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.11:31.1.1+build1-0ubuntu0.14.04.11:31.1.2+build1-0ubuntu0.14.04.11:31.2.0+build2-0ubuntu0.14.04.11:31.3.0+build1-0ubuntu0.14.04.11:31.4.0+build1-0ubuntu0.14.04.11:31.5.0+build1-0ubuntu0.14.04.11:31.6.0+build1-0ubuntu0.14.04.11:31.7.0+build1-0ubuntu0.14.04.11:31.8.0+build1-0ubuntu0.14.04.11:38.2.0+build1-0ubuntu0.14.04.11:38.3.0+build1-0ubuntu0.14.04.11:38.4.0+build3-0ubuntu0.14.04.11:38.5.1+build2-0ubuntu0.14.04.11:38.6.0+build1-0ubuntu0.14.04.11:38.7.2+build1-0ubuntu0.14.04.11:38.8.0+build1-0ubuntu0.14.04.11:45.2.0+build1-0ubuntu0.14.04.31:45.3.0+build1-0ubuntu0.14.04.41:45.4.0+build1-0ubuntu0.14.04.11:45.5.1+build1-0ubuntu0.14.04.11:45.7.0+build1-0ubuntu0.14.04.11:45.8.0+build1-0ubuntu0.14.04.11:52.1.1+build1-0ubuntu0.14.04.11:52.2.1+build1-0ubuntu0.14.04.11:52.3.0+build1-0ubuntu0.14.04.11:52.4.0+build1-0ubuntu0.14.04.21:52.5.0+build1-0ubuntu0.14.04.1
1:52.6.0+build1-0ubuntu0.14.04.1
thunderbird
Ubuntu:16.04:LTS
From an advisory covering 14 CVEs
 before 1:52.6.0+build1-0ubuntu0.16.04.1, plus listed versions
1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.1
Show 11 moreShow less
1:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.11:45.8.0+build1-0ubuntu0.16.04.11:52.1.1+build1-0ubuntu0.16.04.11:52.2.1+build1-0ubuntu0.16.04.11:52.3.0+build1-0ubuntu0.16.04.11:52.4.0+build1-0ubuntu0.16.04.21:52.5.0+build1-0ubuntu0.16.04.1
1:52.6.0+build1-0ubuntu0.16.04.1
MozillaThunderbird
SUSE:Package Hub 12
From an advisory covering 10 CVEs
 before 52.6-54.1
52.6-54.1
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-5096 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published January 25, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.85%, the 86th percentile. Fixed in firefox-esr 52.6.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 35 versions and 293 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open