CVE-2018-5159: canonical ubuntu_linux Integer Overflow or Wraparound
Vulnerability summary
CVE-2018-5159 is a critical (CVSS 9.8) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 20.64% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 21 · Related 10Timeline
- 11-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
20.64%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-0.39 pp
From 21.04% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSkia and Firefox - Integer Overflow in SkTDArray Leading to Out-of-Bounds Write
Maturity: poc
Weaknesses
CWE · root cause- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Redhat6 products
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.6
- enterprise_linux_server_eus7.5 | 7.6
- enterprise_linux_server_tus7.6
Mozilla4 products
- firefox≥ unspecified, < 60 | < 52.8.0 | < 60.0
- firefox_esr≥ unspecified, < 52.8
- thunderbird≥ unspecified, < 52.8 | < 52.8.0
- thunderbird_esr≥ unspecified, < 52.8 | < 52.8.0
Debian3 products
- firefox-esr< 52.8.0esr-1
- thunderbird< 1:52.8.0-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Ubuntu2 products
- firefox< 60.0+build2-0ubuntu0.14.04.1 | < 60.0+build2-0ubuntu0.16.04.1 | < 60.0+build2-0ubuntu1
- thunderbird< 1:52.8.0+build1-0ubuntu0.14.04.1 | < 1:52.8.0+build1-0ubuntu0.16.04.1 | < 1:52.8.0+build1-0ubuntu0.18.04.1
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
5 vendors · 16 products
References
25 links- bugzilla.mozilla.org/show_bug.cgi?id=1441941X Refsource CONFIRMIssue TrackingPermissions RequiredThird Party Advisory
Show all 25 references
- lists.debian.org/debian-lts-announce/2018/05/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2018/05/msg00007.htmlMailing ListX Refsource MLISTThird Party Advisory