cve/2018/CVE-2018-5146.md

### [CVE-2018-5146](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5146)
![](https://img.shields.io/static/v1?label=Product&message=Firefox%20ESR&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Firefox&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=Thunderbird&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2052.7%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2052.7.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3C%2059.0.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Out%20of%20bounds%20memory%20write%20in%20libvorbis&color=brighgreen)

### Description

An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.

### POC

#### Reference
- https://bugzilla.mozilla.org/show_bug.cgi?id=1446062
- https://bugzilla.mozilla.org/show_bug.cgi?id=1446062

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/Live-Hack-CVE/CVE-2020-20412
- https://github.com/f01965/CVE-2018-5146
- https://github.com/lnick2023/nicenice
- https://github.com/qazbnm456/awesome-cve-poc
- https://github.com/xbl3/awesome-cve-poc_qazbnm456