CVE-2019-9815
CVE-2019-9815
This page contains facts from public vulnerability sources. Check the original advisory before updating.
If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. *Note: users need to update to macOS 10.14.5 in order to take advantage of this change.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS 8.1 · High · EPSS 1.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
thunderbird
- Versions
- ≥ unspecified, < 60.7: Affected (custom)
Update to 60.7
firefox
- Versions
- ≥ unspecified, < 67: Affected (custom)
Update to 67
firefox esr
- Versions
- ≥ unspecified, < 60.7: Affected (custom)
Update to 60.7
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published