CVE-2018-5147
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in...
9.8 CriticalFix available
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
2.39%Up 0.5 points since Apr 14, 2021
What each source reports
NVD Score used
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
CVE-2018-5147- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
CVE-2018-5147- Updated
- 2026-11-02
EUVDEUVD-2018-16933 No score
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
EUVD-2018-16933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mxw3-h8f2-qrw5
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in...
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
GHSA-mxw3-h8f2-qrw5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
CVE-2018-5147- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-5147
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
DEBIAN-CVE-2018-5147- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2018-5147
The libtremor library has the same flaw as CVE-2018-5146. This library is used by Firefox in place of libvorbis on Android and ARM platforms. This vulnerability affects Firefox ESR < 52.7.2 and Firefox < 59.0.1.
- Record
UBUNTU-CVE-2018-5147- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score
MozillaFirefox-92.0-1.2 on GA media
These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10600-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0850-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130):
- CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
- CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
- CVE-2018-5129: Out-of-bounds write with malformed IPC messages
- CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
- CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
- CVE-2018-5144: Integer overflow during Unicode conversion
- CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7
- CVE-2018-5146: Out of bounds memory write in libvorbis (bsc#1085671)
- CVE-2018-5147: Out of bounds memory write in libtremor (bsc#1085671)
- CVE-2018-5148: Use-after-free in compositor (MFSA 2018-10) (bsc#1087059)
- Record
SUSE-SU-2018:0850-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0907-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130):
- CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
- CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
- CVE-2018-5129: Out-of-bounds write with malformed IPC messages
- CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
- CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
- CVE-2018-5144: Integer overflow during Unicode conversion
- CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7
- CVE-2018-5146: Out of bounds memory write in libvorbis (bsc#1085671)
- CVE-2018-5147: Out of bounds memory write in libtremor (bsc#1085671)
- CVE-2018-5148: Use-after-free in compositor (MFSA 2018-10) (bsc#1087059)
- Record
SUSE-SU-2018:0907-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrDebian:12 |
before 52.7.2esr-1 | 52.7.2esr-1 |
firefox-esrDebian:13 |
before 52.7.2esr-1 | 52.7.2esr-1 |
firefox-esrDebian:14 |
before 52.7.2esr-1 | 52.7.2esr-1 |
libvorbisidecDebian:12 |
before 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
libvorbisidecDebian:13 |
before 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
libvorbisidecDebian:14 |
before 1.2.1+git20180316-1 | 1.2.1+git20180316-1 |
libvorbisidecDebian:7 |
before 1.0.2+svn18153-0.2+deb7u1, plus listed versions 1.0.2+svn18153-0.2 |
1.0.2+svn18153-0.2+deb7u1 |
firefox-esrDebian:7 From an advisory covering 2 CVEs |
before 52.7.2esr-1~deb7u1, plus listed versions 45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1 Show 45 moreShow less45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1 |
52.7.2esr-1~deb7u1 |
libvorbisidecDebian:8 |
before 1.0.2+svn18153-1~deb8u2, plus listed versions 1.0.2+svn18153-0.21.0.2+svn18153-1~deb8u1 |
1.0.2+svn18153-1~deb8u2 |
libvorbisidecDebian:9 |
before 1.0.2+svn18153-1+deb9u1, plus listed versions 1.0.2+svn18153-1 |
1.0.2+svn18153-1+deb9u1 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
firefox-esrDebian:8 From an advisory covering 2 CVEs |
before 52.7.2esr-1~deb8u1, plus listed versions 45.0.1esr-145.0.2esr-145.0esr-145.0esr-245.1.0esr-1 Show 45 moreShow less45.1.1esr-145.2.0esr-145.2.0esr-1~deb7u145.2.0esr-1~deb8u145.3.0esr-145.3.0esr-1~deb7u145.3.0esr-1~deb8u145.3.0esr-245.4.0esr-145.4.0esr-1~deb7u145.4.0esr-1~deb7u245.4.0esr-1~deb8u145.4.0esr-1~deb8u245.4.0esr-245.5.0esr-145.5.0esr-1~deb8u145.5.1esr-145.5.1esr-1~deb7u145.5.1esr-1~deb8u145.6.0esr-145.6.0esr-1~deb7u145.6.0esr-1~deb8u145.7.0esr-145.7.0esr-1~deb7u145.7.0esr-1~deb8u145.7.0esr-245.7.0esr-345.7.0esr-445.8.0esr-145.8.0esr-1~deb7u145.8.0esr-1~deb8u145.9.0esr-145.9.0esr-1~deb7u145.9.0esr-1~deb8u152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-152.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u1 |
52.7.2esr-1~deb8u1 |
firefox-esrDebian:9 From an advisory covering 2 CVEs |
before 52.7.2esr-1~deb9u1, plus listed versions 45.9.0esr-152.0.1esr-152.0.2esr-152.0esr-152.1.0esr-1 Show 40 moreShow less52.2.0esr-152.2.0esr-1~deb7u152.2.0esr-1~deb8u152.2.0esr-1~deb9u152.2.0esr-252.3.0esr-152.3.0esr-1~deb7u152.3.0esr-1~deb8u152.3.0esr-1~deb8u252.3.0esr-1~deb9u152.3.0esr-252.4.0esr-1~deb8u152.4.0esr-1~deb9u152.4.0esr-252.4.0esr-2~deb7u152.5.0esr-152.5.0esr-1~deb7u152.5.0esr-1~deb8u152.5.0esr-1~deb9u152.5.2esr-152.5.2esr-1~deb7u152.5.2esr-1~deb8u152.5.2esr-1~deb9u152.5.3esr-152.6.0esr-152.6.0esr-1~deb7u152.6.0esr-1~deb8u152.6.0esr-1~deb9u152.6.0esr-252.6.0esr-2+alpha.152.6.0esr-2+alpha.252.7.0esr-152.7.0esr-1~deb8u152.7.0esr-1~deb9u152.7.1esr-152.7.1esr-1~deb7u152.7.1esr-1~deb8u152.7.1esr-1~deb9u152.7.2esr-1~deb7u152.7.2esr-1~deb8u1 |
52.7.2esr-1~deb9u1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP2 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP2 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP3 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 10 CVEs |
before 52.7.3esr-109.25.1 | 52.7.3esr-109.25.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 11 SP4 From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
MozillaFirefoxSUSE:Linux Enterprise Point of Sale 11 SP3 From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP3-LTSS From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP3-TERADATA From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
MozillaFirefoxSUSE:Linux Enterprise Server 11 SP4 From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 11 SP4 From an advisory covering 10 CVEs |
before 52.7.3esr-72.27.2 | 52.7.3esr-72.27.2 |
libvorbisidecUbuntu:14.04:LTS |
before 1.0.2+svn18153-0.2+deb7u1build0.14.04.1, plus listed versions 1.0.2+svn18153-0.2 |
1.0.2+svn18153-0.2+deb7u1build0.14.04.1 |
firefoxUbuntu:16.04:LTS |
before 59.0.1+build1-0ubuntu0.16.04.1, plus listed versions 41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu1 Show 34 moreShow less45.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.247.0+build3-0ubuntu0.16.04.148.0+build2-0ubuntu0.16.04.149.0+build4-0ubuntu0.16.04.149.0.2+build2-0ubuntu0.16.04.250.0+build2-0ubuntu0.16.04.250.0.2+build1-0ubuntu0.16.04.150.1.0+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.151.0.1+build2-0ubuntu0.16.04.252.0+build2-0ubuntu0.16.04.152.0.1+build2-0ubuntu0.16.04.152.0.2+build1-0ubuntu0.16.04.153.0+build6-0ubuntu0.16.04.153.0.2+build1-0ubuntu0.16.04.253.0.3+build1-0ubuntu0.16.04.254.0+build3-0ubuntu0.16.04.155.0.1+build2-0ubuntu0.16.04.255.0.2+build1-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.156.0+build6-0ubuntu0.16.04.257.0+build4-0ubuntu0.16.04.557.0+build4-0ubuntu0.16.04.657.0.1+build2-0ubuntu0.16.04.157.0.3+build1-0ubuntu0.16.04.157.0.4+build1-0ubuntu0.16.04.158.0+build6-0ubuntu0.16.04.158.0.1+build1-0ubuntu0.16.04.158.0.2+build1-0ubuntu0.16.04.159.0+build5-0ubuntu0.16.04.1 |
59.0.1+build1-0ubuntu0.16.04.1 |
libvorbisidecUbuntu:16.04:LTS |
before 1.0.2+svn18153-0.2+deb7u1build0.16.04.1, plus listed versions 1.0.2+svn18153-0.2 |
1.0.2+svn18153-0.2+deb7u1build0.16.04.1 |
firefoxUbuntu:18.04:LTS |
before 59.0.1+build1-0ubuntu1, plus listed versions 56.0+build6-0ubuntu157.0.1+build2-0ubuntu1 |
59.0.1+build1-0ubuntu1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 661 CVEs |
before 92.0-1.2 | 92.0-1.2 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-5147 is a critical vulnerability (CVSS 9.8) in Mozilla Firefox, published March 16, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.39%, the 84th percentile. Fixed in firefox-esr 52.7.2esr-1.
References
debian.org/security/2018/dsa-4143
lists.debian.org/debian-lts-announce/2018/03/msg00022.html
bugzilla.mozilla.org/show_bug.cgi?id=1446365
mozilla.org/security/advisories/mfsa2018-08
securitytracker.com/id/1040544
Show 194 moreShow less
securityfocus.com/bid/103432
nvd.nist.gov/vuln/detail/CVE-2018-5147
github.com/advisories/GHSA-mxw3-h8f2-qrw5
security-tracker.debian.org/tracker/CVE-2018-5147
suse.com/support/update/announcement/2018/suse-su-20180850-1
bugzilla.suse.com/1085130
ubuntu.com/security/CVE-2018-5147
git.xiph.org?p=tremor.git;a=commit;h=562307a4a7082e24553f3d2c55dab397a17c4b4f
cve.org/CVERecord?id=CVE-2018-5147
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 63 versions and 1,683 references. The JSON record has them.