In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
21 Nov 2024, 03:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/104561 - Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id/1041193 - Third Party Advisory, VDB Entry | |
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1462891 - Issue Tracking, Permissions Required, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html - Mailing List, Third Party Advisory | |
| References | () https://security.gentoo.org/glsa/201810-01 - Third Party Advisory | |
| References | () https://security.gentoo.org/glsa/201811-13 - Third Party Advisory | |
| References | () https://usn.ubuntu.com/3705-1/ - Third Party Advisory | |
| References | () https://www.debian.org/security/2018/dsa-4295 - Third Party Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2018-15/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2018-16/ - Vendor Advisory | |
| References | () https://www.mozilla.org/security/advisories/mfsa2018-19/ - Vendor Advisory |
Information
Published : 2018-10-18 13:29
Updated : 2024-11-21 03:45
NVD link : CVE-2018-12367
Mitre link : CVE-2018-12367
CVE.ORG link : CVE-2018-12367
JSON object : View
Products Affected
mozilla
- firefox
- firefox_esr
- thunderbird
canonical
- ubuntu_linux
debian
- debian_linux
CWE
CWE-20
Improper Input Validation