CVEvulnerability

CVE-2018-5407

4.7 MEDIUM Published 2018-11-15 Modified 2026-10-08 Official page ↗
Status
Modified
Published
2018-11-15
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.7 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200, CWE-203

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Affected configurations

• canonical ubuntu linux 14.04 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 18.10 • debian debian linux 8.0 • debian debian linux 9.0 • nodejs node.js (< 6.14.4) • nodejs node.js (>= 8.0.0 < 8.11.4) • nodejs node.js (>= 10.0.0 < 10.9.0) • openssl openssl (>= 1.0.2 < 1.0.2q) • openssl openssl (>= 1.1.0 < 1.1.0i) • tenable nessus (< 8.1.1) • oracle api gateway 11.1.2.4.0 • oracle application server 0.9.8 • oracle application server 1.0.0 • oracle application server 1.0.1 • oracle enterprise manager base platform 12.1.0.5.0 • oracle enterprise manager base platform 13.2.0.0.0 • oracle enterprise manager base platform 13.3.0.0.0 • oracle enterprise manager ops center 12.3.3 • oracle mysql enterprise backup (<= 3.12.3) • oracle mysql enterprise backup (>= 3.12.4 <= 4.1.2) • oracle peoplesoft enterprise peopletools 8.55 • oracle peoplesoft enterprise peopletools 8.56 • oracle peoplesoft enterprise peopletools 8.57 • oracle primavera p6 enterprise project portfolio management (>= 17.7 <= 17.12) • oracle primavera p6 enterprise project portfolio management 8.4 • oracle primavera p6 enterprise project portfolio management 15.1 • oracle primavera p6 enterprise project portfolio management 15.2 • oracle primavera p6 enterprise project portfolio management 16.1 • oracle primavera p6 enterprise project portfolio management 16.2 • oracle primavera p6 enterprise project portfolio management 18.8 • oracle tuxedo 12.1.1.0.0 • oracle vm virtualbox (< 6.0.0) • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server 7.6 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server eus 7.6 • redhat enterprise linux server tus 7.6 • redhat enterprise linux workstation 7.0

Related

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-203 Observable Discrepancy weakness

References