CVE-2019-11745

Published: Jan 8, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Affected (17)

Products: Mozilla: Firefox, Firefox Esr, Thunderbird · Opensuse: Leap · Canonical: Ubuntu Linux · +3 more

Show all products

3 products

1 product

1 product

1 product

1 product

Enterprise Linux Server Aus

Siemens

8 products

Ruggedcom Rox Mx5000 Firmware

Ruggedcom Rox Rx1400 Firmware

Ruggedcom Rox Rx1500 Firmware

Ruggedcom Rox Rx1501 Firmware

Ruggedcom Rox Rx1510 Firmware

Ruggedcom Rox Rx1511 Firmware

Ruggedcom Rox Rx1512 Firmware

Ruggedcom Rox Rx5000 Firmware

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 71.0
Mozilla Firefox Esr	Before 68.3
Mozilla Thunderbird	Before 68.3.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.10

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Server Aus	Version 6.6

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Mx5000 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Mx5000	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1400 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1400	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1500 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1500	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1501 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1501	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1510 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1510	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1511 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1511	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx1512 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx1512	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Ruggedcom Rox Rx5000 Firmware	Before 2.14.0

Running on/with	Platform Versions
Siemens Ruggedcom Rox Rx5000	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html

Source: security@mozilla.org

Issue TrackingMailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2020:0243

Source: security@mozilla.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0466

Source: security@mozilla.org

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=1586176

Source: security@mozilla.org

Issue TrackingPatchVendor Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf

Source: security@mozilla.org

Third Party Advisory

https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/202003-02

Source: security@mozilla.org

Third Party Advisory

https://security.gentoo.org/glsa/202003-10

Source: security@mozilla.org

Third Party Advisory

https://security.gentoo.org/glsa/202003-37

Source: security@mozilla.org

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04

Source: security@mozilla.org

Third Party AdvisoryUS Government Resource

https://usn.ubuntu.com/4241-1/

Source: security@mozilla.org

Third Party Advisory

https://usn.ubuntu.com/4335-1/

Source: security@mozilla.org

Third Party Advisory

https://www.mozilla.org/security/advisories/mfsa2019-36/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2019-37/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2019-38/

Source: security@mozilla.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html