CVE-2019-9815

CVSS v3.0 8.1 (High)

CVSS v2.0 6.8 (Medium)

EPSS 0.67 % (80^th)

Affected Products 4

Advisories 11

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. Note: users need to update to macOS 10.14.5 in order to take advantage of this change.. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Weaknesses

CWE-203: Observable Discrepancy

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2019-07-23 14:15:17
(5 years ago)
Updated Date: 2021-09-08 17:22:01
(3 years ago)

Affected Products

Apple

Macos

Mozilla

Configuration #1

AND

		CPE23	Up To
OR
	Mozilla Firefox prior 67.0 version	cpe:2.3:a:mozilla:firefox	< 67.0
OR
	Running on/with
	Mozilla Firefox Esr prior 60.7 version	cpe:2.3:a:mozilla:firefox_esr	< 60.7
OR
	Running on/with
	Mozilla Thunderbird prior 60.7 version	cpe:2.3:a:mozilla:thunderbird	< 60.7
OR
	Running on/with
	Apple Macos	cpe:2.3:o:apple:macos:-