CVE-2019-11745

Description

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Scores

Weaknesses (CWE)

• CWE-787

European references

• ENISA EUVD · EUVD-2019-3415
• GCVE · GCVE-0-2019-11745

CERT-FR advisories

• CERTFR-2024-AVI-1103 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
• CERTFR-2021-AVI-952 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2021-AVI-912 — Multiples vulnérabilités dans IBM Qradar · cert.ssi.gouv.fr
• CERTFR-2021-AVI-094 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
• CERTFR-2019-AVI-609 — Multiples vulnérabilités dans Mozilla Thunderbird · cert.ssi.gouv.fr
• CERTFR-2019-AVI-605 — Multiples vulnérabilités dans Mozilla Firefox · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* < 71.0
• cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* < 68.3
• cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* < 68.3.0
• cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
• cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
• cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:* < 2.14.0
• cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:* < 2.14.0

Affected products

References

• https://www.mozilla.org/security/advisories/mfsa2019-36/
• https://www.mozilla.org/security/advisories/mfsa2019-38/
• https://www.mozilla.org/security/advisories/mfsa2019-37/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1586176
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html
• https://usn.ubuntu.com/4241-1/
• https://access.redhat.com/errata/RHSA-2020:0243
• https://access.redhat.com/errata/RHSA-2020:0466
• https://security.gentoo.org/glsa/202003-02
• https://security.gentoo.org/glsa/202003-10
• https://security.gentoo.org/glsa/202003-37
• https://usn.ubuntu.com/4335-1/
• https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

Sources