2 lines
4.6 KiB
JSON
2 lines
4.6 KiB
JSON
{"affected":[{"affectedData":[{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThanOrEqual":"115.*","status":"unaffected","version":"115.23.1","versionType":"rpm"},{"lessThanOrEqual":"128.*","status":"unaffected","version":"128.10.1","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"138.0.4","versionType":"rpm"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThanOrEqual":"128.*","status":"unaffected","version":"128.10.2","versionType":"rpm"},{"lessThanOrEqual":"*","status":"unaffected","version":"138.0.2","versionType":"rpm"}]}],"source":"security@mozilla.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*","matchCriteriaId":"BD156D89-BD24-483A-A355-1B45A0A2E66F","versionEndExcluding":"115.23.1","vulnerable":true},{"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*","matchCriteriaId":"83AE9635-80D1-49DD-B7A5-8E4E235B1C87","versionEndExcluding":"138.0.4","vulnerable":true},{"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*","matchCriteriaId":"7F2F0DE1-8619-4C18-83B0-46E543AE8E9E","versionEndExcluding":"128.10.1","versionStartIncluding":"116.0","vulnerable":true},{"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","matchCriteriaId":"08FDB838-27AF-43C3-AC02-27C34ED5481A","versionEndExcluding":"128.10.2","vulnerable":true},{"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*","matchCriteriaId":"F76ABBB9-7E44-45A0-BEE9-81CD9C0A33ED","versionEndExcluding":"138.0.2","versionStartIncluding":"138.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."},{"lang":"es","value":"Un atacante logró realizar una lectura o escritura fuera de los límites en un objeto “Promise” de JavaScript. Esta vulnerabilidad afecta a Firefox (versión anterior a 138.0.4), Firefox ESR (versión anterior a 128.10.1) y Firefox ESR (versión anterior a 115.23.1)."}],"id":"CVE-2025-4918","lastModified":"2026-09-30T18:10:00.190","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4918","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-20T03:55:17.219008Z","version":"2.0.3"}}]},"published":"2025-05-17T22:15:19.563","references":[{"source":"security@mozilla.org","tags":["Permissions Required"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1966612"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2025-36/"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2025-37/"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2025-38/"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2025-40/"},{"source":"security@mozilla.org","tags":["Vendor Advisory"],"url":"https://www.mozilla.org/security/advisories/mfsa2025-41/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://www.vicarius.io/vsociety/posts/cve-2025-4918-detect-firefox-out-of-bounds-write"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"],"url":"https://www.vicarius.io/vsociety/posts/cve-2025-4918-mitigate-firefox-out-of-bounds-write"}],"sourceIdentifier":"security@mozilla.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-125"},{"lang":"en","value":"CWE-787"}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}
|