CVE-2018-12367

In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.

Link	Resource
https://www.mozilla.org/security/advisories/mfsa2018-19/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-16/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2018-15/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1462891	Issue Tracking Permissions Required
https://www.debian.org/security/2018/dsa-4295	Third Party Advisory
https://usn.ubuntu.com/3705-1/	Third Party Advisory
http://www.securitytracker.com/id/1041193	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/104561	Third Party Advisory VDB Entry
https://security.gentoo.org/glsa/201810-01	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html	Mailing List Third Party Advisory
https://security.gentoo.org/glsa/201811-13	Third Party Advisory

Configuration 1

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*

---

Published : 2018-10-18 01:29

Updated : 2018-12-06 03:10

---

NVD link : CVE-2018-12367

Mitre link : CVE-2018-12367

No products.

CWE-20