CVE-2016-9074
nss: Insufficient timing side-channel resistance in divSpoiler
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 15, 2016
Updated · January 14, 2026
Description
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 3.7CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-385 · Covert Timing Channel