CVEs-PoC/2018/CVE-2018-18500.md

CVE-2018-18500

Description

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements. This results in the stream parser object being freed while still in use, leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 60.5, Firefox ESR < 60.5, and Firefox < 65.

POC

Reference

• https://usn.ubuntu.com/3874-1/

Github

• https://github.com/0xT11/CVE-POC
• https://github.com/ZihanYe/web-browser-vulnerabilities
• https://github.com/alphaSeclab/sec-daily-2019
• https://github.com/sophoslabs/CVE-2018-18500