{"id":"CVE-2018-5407","details":"Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.","modified":"2026-09-10T03:46:16.564371219Z","published":"2018-11-15T21:29:00.233Z","related":["SUSE-FU-2022:0445-1","SUSE-SU-2018:3864-1","SUSE-SU-2018:3864-2","SUSE-SU-2018:3866-1","SUSE-SU-2018:3964-1","SUSE-SU-2018:3989-1","SUSE-SU-2018:4001-1","SUSE-SU-2018:4068-1","SUSE-SU-2018:4274-1","SUSE-SU-2019:0117-1","SUSE-SU-2019:0395-1","SUSE-SU-2019:1553-1","openSUSE-SU-2024:11126-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_RANGE","vendor_product":"oracle:mysql_enterprise_backup","cpes":["cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"3.12.3"},{"introduced":"3.12.4"},{"last_affected":"4.1.2"}]},{"source":"CPE_RANGE","vendor_product":"oracle:primavera_p6_enterprise_project_portfolio_management","cpes":["cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.7"},{"last_affected":"17.12"}]},{"cpes":["cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"6.0.0"}],"source":"CPE_RANGE","vendor_product":"oracle:vm_virtualbox"},{"extracted_events":[{"fixed":"8.1.1"}],"source":"CPE_RANGE","vendor_product":"tenable:nessus","cpes":["cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*"]},{"source":"CPE_STRING","vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"14.04"},{"last_affected":"14.04"},{"introduced":"16.04"},{"last_affected":"16.04"},{"introduced":"18.04"},{"last_affected":"18.04"},{"introduced":"18.10"},{"last_affected":"18.10"}]},{"extracted_events":[{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]},{"vendor_product":"oracle:api_gateway","cpes":["cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.1.2.4.0"},{"last_affected":"11.1.2.4.0"}],"source":"CPE_STRING"},{"extracted_events":[{"introduced":"0.9.8"},{"last_affected":"0.9.8"},{"introduced":"1.0.1"},{"last_affected":"1.0.1"}],"source":"CPE_STRING","vendor_product":"oracle:application_server","cpes":["cpe:2.3:a:oracle:application_server:0.9.8:*:*:*:*:*:*:*","cpe:2.3:a:oracle:application_server:1.0.1:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*","cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.0.5.0"},{"last_affected":"12.1.0.5.0"},{"introduced":"13.2.0.0.0"},{"last_affected":"13.2.0.0.0"},{"introduced":"13.3.0.0.0"},{"last_affected":"13.3.0.0.0"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_base_platform"},{"cpes":["cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.3.3"},{"last_affected":"12.3.3"}],"source":"CPE_STRING","vendor_product":"oracle:enterprise_manager_ops_center"},{"source":"CPE_STRING","vendor_product":"oracle:peoplesoft_enterprise_peopletools","cpes":["cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*","cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.55"},{"last_affected":"8.55"},{"introduced":"8.56"},{"last_affected":"8.56"},{"introduced":"8.57"},{"last_affected":"8.57"}]},{"source":"CPE_STRING","vendor_product":"oracle:primavera_p6_enterprise_project_portfolio_management","cpes":["cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.4"},{"last_affected":"8.4"},{"introduced":"15.1"},{"last_affected":"15.1"},{"introduced":"15.2"},{"last_affected":"15.2"},{"introduced":"16.1"},{"last_affected":"16.1"},{"introduced":"16.2"},{"last_affected":"16.2"},{"introduced":"18.8"},{"last_affected":"18.8"}]},{"vendor_product":"oracle:tuxedo","cpes":["cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12.1.1.0.0"},{"last_affected":"12.1.1.0.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_desktop"},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server"},{"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_aus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6"},{"last_affected":"7.6"}]},{"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_eus","cpes":["cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6"},{"last_affected":"7.6"}]},{"cpes":["cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6"},{"last_affected":"7.6"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_server_tus"},{"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"}],"source":"CPE_STRING","vendor_product":"redhat:enterprise_linux_workstation","cpes":["cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/105897"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0483"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:0652"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:2125"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3929"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3931"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3932"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3933"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2019:3935"},{"type":"ADVISORY","url":"https://eprint.iacr.org/2018/1060.pdf"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html"},{"type":"ADVISORY","url":"https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201903-10"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20181126-0001/"},{"type":"ADVISORY","url":"https://usn.ubuntu.com/3840-1/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4348"},{"type":"ADVISORY","url":"https://www.debian.org/security/2018/dsa-4355"},{"type":"ADVISORY","url":"https://www.tenable.com/security/tns-2018-16"},{"type":"ADVISORY","url":"https://www.tenable.com/security/tns-2018-17"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2020.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"type":"EVIDENCE","url":"https://github.com/bbbrumley/portsmash"},{"type":"EVIDENCE","url":"https://www.exploit-db.com/exploits/45785/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bbbrumley/portsmash","events":[{"introduced":"014b1cf4b5e203d849e55387564a28994b01c708"},{"last_affected":"014b1cf4b5e203d849e55387564a28994b01c708"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"last_affected":"1.0.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:oracle:application_server:1.0.0:*:*:*:*:*:*:*"}}],"versions":["1.0.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-5407.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/nodejs/node","events":[{"introduced":"0"},{"fixed":"1cb5aed5f596a9cb5b68e3a676222c0c35501a5e"},{"introduced":"0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba"},{"fixed":"0cae3c3fe5e3f4c275701446a4baf1f2727344f6"},{"introduced":"cf41627411886000429bde058a6594fb7f6d6d47"},{"fixed":"03b825811ed4af0addcdf6e75bacb3dc1c4c5940"}],"database_specific":{"cpe":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.14.4"},{"introduced":"8.0.0"},{"fixed":"8.11.4"},{"introduced":"10.0.0"},{"fixed":"10.9.0"}],"source":"CPE_RANGE"}}],"versions":["v10.8.0","v10.7.0","v10.6.0","v10.5.0","v10.4.1","v8.11.3","v6.14.3","v10.4.0","v10.3.0","v10.2.1","v10.2.0","v8.11.2","v10.1.0","v6.14.2","v10.0.0","v8.11.1","v6.14.1","v6.14.0","v8.11.0","v8.10.0","v6.13.1","v6.13.0","v8.9.4","v6.12.3","v8.9.3","v6.12.2","v8.9.2","v6.12.1","v8.9.1","v6.12.0","v8.9.0","v8.8.1","v6.11.5","v8.8.0","v8.7.0","v6.11.4","v8.6.0","v8.5.0","v6.11.3","v8.4.0","v8.3.0","v6.11.2","v8.2.1","v8.2.0","v8.1.4","v6.11.1","v8.1.3","v8.1.2","v8.1.1","v8.1.0","v6.11.0","v8.0.0","v6.10.3","v6.10.2","v6.10.1","v6.10.0","v6.9.5","v6.9.4","v6.9.3","v6.9.2","v6.9.1","v6.9.0","v6.8.1","v6.8.0","v6.7.0","v6.6.0","v6.5.0","v6.4.0","v6.3.1","v6.3.0","v6.2.2","v6.2.1","v6.2.0","v6.1.0","v6.0.0","v3.0.0","v2.5.0","v2.4.0","v2.3.4","v2.3.3","v2.3.2","v2.3.1","v2.3.0","v2.2.1","v2.2.0","v2.1.0","v2.0.2","v2.0.1","v2.0.0","v1.7.1","v1.7.0","v1.6.4","v1.6.3","v1.6.2","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.3","v1.4.2","v1.4.1","v1.3.0","v1.2.0","v1.1.0","v1.0.4","v1.0.3","v1.0.2-release","v1.0.2","v1.0.1-release","v1.0.1","v0.7.3","v0.7.2","v0.7.0","v0.6.1","v0.6.0","v0.5.10","v0.5.9","v0.5.8","v0.5.7","v0.5.6","v0.5.5-rc1","v0.5.5","v0.5.4","v0.5.3","v0.5.2","v0.5.1","v0.5.0","v0.4.0","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.2","v0.3.1","v0.3.0","v0.2.0","v0.1.104","v0.1.103","v0.1.102","v0.1.101","v0.1.100","v0.1.99","v0.1.98","v0.1.97","v0.1.96","v0.1.95","v0.1.94","v0.1.93","v0.1.92","v0.1.33","v0.1.32","v0.1.31","v0.1.30","v0.1.29","v0.1.28","v0.1.27","v0.1.26","v0.1.25","v0.1.24","v0.1.23","v0.1.22","v0.1.21","v0.1.20","v0.1.19","v0.1.18","v0.1.17","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0","v0.0.6","v0.0.4","v0.0.3","v0.0.2","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-5407.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"7b560c174dcd569795f5be66e0c091d1be440614"},{"fixed":"7b560c174dcd569795f5be66e0c091d1be440614"},{"introduced":"ac2c44c6289f9716de4c4beeb284a818eacde517"},{"fixed":"ac2c44c6289f9716de4c4beeb284a818eacde517"}],"database_specific":{"cpe":"cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.2"},{"fixed":"1.0.2q"},{"introduced":"1.1.0"},{"fixed":"1.1.0i"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-5407.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}