CVE-2018-12363

Source
Severity High
Remote Yes
Type Arbitrary code execution
Description
A use-after-free vulnerability can occur in Firefox before 61.0 and Thunderbird before 52.9 when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash.
Group Package Affected Fixed Severity Status Ticket
AVG-728 thunderbird 52.8.0-1 52.9.1-1 Critical Fixed
AVG-727 firefox 60.0.2-1 61.0-1 Critical Fixed
Date Advisory Group Package Severity Description
27 Jun 2018 ASA-201806-14 AVG-727 firefox Critical multiple issues
References
https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/#CVE-2018-12363
https://bugzilla.mozilla.org/show_bug.cgi?id=1464784