CVE-2018-18493
📋 TL;DR
A buffer overflow vulnerability in the Skia graphics library allows attackers to cause memory corruption through specially crafted 2D canvas operations. This affects Thunderbird, Firefox ESR, and Firefox browsers when using hardware acceleration, potentially leading to remote code execution. Users running affected versions are vulnerable to exploitation via malicious web content.
💻 Affected Systems
- Mozilla Thunderbird
- Mozilla Firefox ESR
- Mozilla Firefox
📦 What is this software?
Firefox by Mozilla
Firefox by Mozilla
Thunderbird by Mozilla
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or installation of persistent malware.
Likely Case
Application crash (denial of service) or limited memory corruption that could be leveraged for further exploitation.
If Mitigated
No impact if patched versions are deployed or hardware acceleration is disabled.
🎯 Exploit Status
Exploitation requires bypassing ASLR/DEP protections; no public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Thunderbird 60.4, Firefox ESR 60.4, Firefox 64
Vendor Advisory: https://access.redhat.com/errata/RHSA-2018:3831
Restart Required: Yes
Instructions:
1. Update Thunderbird to version 60.4 or later. 2. Update Firefox ESR to version 60.4 or later. 3. Update Firefox to version 64 or later. 4. Restart the browser after update.
🔧 Temporary Workarounds
Disable hardware acceleration
allPrevents exploitation by disabling the vulnerable hardware-accelerated canvas feature.
In Firefox/Thunderbird: Settings → General → Performance → Uncheck 'Use recommended performance settings' → Uncheck 'Use hardware acceleration when available'
🧯 If You Can't Patch
- Implement network filtering to block malicious web content using web proxies or firewalls.
- Restrict browser usage to trusted websites only and disable JavaScript for untrusted sites.
🔍 How to Verify
Check if Vulnerable:
Check browser version: Thunderbird < 60.4, Firefox ESR < 60.4, or Firefox < 64 indicates vulnerability.Check Version:
Firefox/Thunderbird: Help → About Firefox/ThunderbirdVerify Fix Applied:
Confirm browser version is Thunderbird ≥ 60.4, Firefox ESR ≥ 60.4, or Firefox ≥ 64.📡 Detection & Monitoring
Log Indicators:
- Browser crash logs referencing skia.dll/libskia.so, memory access violations, or segmentation faults
Network Indicators:
- Unusual web traffic to sites hosting canvas-heavy content or known exploit kits
SIEM Query:
source="browser_logs" AND (event="crash" OR error="segmentation_fault") AND process="firefox" OR process="thunderbird"🔗 References
- http://www.securityfocus.com/bid/106168
- https://access.redhat.com/errata/RHSA-2018:3831
- https://access.redhat.com/errata/RHSA-2018:3833
- https://access.redhat.com/errata/RHSA-2019:0159
- https://access.redhat.com/errata/RHSA-2019:0160
- https://bugzilla.mozilla.org/show_bug.cgi?id=1504452
- https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html
- https://security.gentoo.org/glsa/201903-04
- https://usn.ubuntu.com/3844-1/
- https://usn.ubuntu.com/3868-1/
- https://www.debian.org/security/2018/dsa-4354
- https://www.debian.org/security/2019/dsa-4362
- https://www.mozilla.org/security/advisories/mfsa2018-29/
- https://www.mozilla.org/security/advisories/mfsa2018-30/
- https://www.mozilla.org/security/advisories/mfsa2018-31/
- http://www.securityfocus.com/bid/106168
- https://access.redhat.com/errata/RHSA-2018:3831
- https://access.redhat.com/errata/RHSA-2018:3833
- https://access.redhat.com/errata/RHSA-2019:0159
- https://access.redhat.com/errata/RHSA-2019:0160
- https://bugzilla.mozilla.org/show_bug.cgi?id=1504452
- https://lists.debian.org/debian-lts-announce/2018/12/msg00002.html
- https://security.gentoo.org/glsa/201903-04
- https://usn.ubuntu.com/3844-1/
- https://usn.ubuntu.com/3868-1/
- https://www.debian.org/security/2018/dsa-4354
- https://www.debian.org/security/2019/dsa-4362
- https://www.mozilla.org/security/advisories/mfsa2018-29/
- https://www.mozilla.org/security/advisories/mfsa2018-30/
- https://www.mozilla.org/security/advisories/mfsa2018-31/
