Mozilla Thunderbird
En bref
- Source
- NVD
- EPSS
- EPSS 1.98 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Description
In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
Faiblesses (CWE)
- CWE-20 — Validation d'entrée incorrecte
Références
- https://security.gentoo.org/glsa/201810-01
- https://www.mozilla.org/security/advisories/mfsa2018-15/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1462891
- https://lists.debian.org/debian-lts-announce/2018/11/msg00011.html
- https://security.gentoo.org/glsa/201811-13
- https://www.debian.org/security/2018/dsa-4295
- https://www.mozilla.org/security/advisories/mfsa2018-16/
- http://www.securitytracker.com/id/1041193
- https://www.mozilla.org/security/advisories/mfsa2018-19/
- https://usn.ubuntu.com/3705-1/
- http://www.securityfocus.com/bid/104561
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-4341
- GCVE · GCVE-0-2018-12367
Avis du CERT-FR
- CERTFR-2018-AVI-373 — Multiples vulnérabilités dans Mozilla Thunderbird · cert.ssi.gouv.fr
- CERTFR-2018-AVI-309 — Multiples vulnérabilités dans Mozilla Firefox · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*< 60.1.0cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*< 61.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*< 60.0
Produits affectés
| Produit | Versions |
|---|---|
| Mozilla · Thunderbird | affected unspecified < 60 |
| Mozilla · Firefox ESR | affected unspecified < 60.1 |
| Mozilla · Firefox | affected unspecified < 61 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |