CVE-2018-12367: Input Validation
In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, and Firefox < 61.
Other sources
In the previous mitigations for Spectre, the resolution or precision of various methods was reduced to counteract the ability to measure precise time intervals. In that work, PerformanceNavigationTiming was not adjusted but it was found that it could be used as a precision timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 61 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 147.0.4-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.7.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.7.1esr-1~deb12u1Fixed in 1:140.6.0esr-1~deb13u1Fixed in 1:140.7.1esr-1~deb13u1Fixed in 1:140.7.1esr-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 60 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 60 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 60.1 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 61
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2018-12367?
CVE-2018-12367 has a medium severity rating due to its potential to expose sensitive information through precision timing attacks.
How do I fix CVE-2018-12367?
To resolve CVE-2018-12367, users should upgrade their affected software to the latest version provided by Mozilla and the respective distributors.
Which software is affected by CVE-2018-12367?
CVE-2018-12367 affects older versions of Mozilla Firefox, Firefox ESR, and Thunderbird, specifically versions prior to 61, 60.1, and 60, respectively.
Can CVE-2018-12367 be exploited remotely?
CVE-2018-12367 can potentially be exploited remotely through JavaScript running in the browser, making it a concern for web users.
Is there a workaround for CVE-2018-12367?
There is no effective workaround for CVE-2018-12367, and the best course of action is to update the software to the patched versions.