CVE-2019-11745

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-11745
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html Issue Tracking Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0243 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0466 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 Issue Tracking Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-02 Third Party Advisory
https://security.gentoo.org/glsa/202003-10 Third Party Advisory
https://security.gentoo.org/glsa/202003-37 Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 Third Party Advisory US Government Resource
https://usn.ubuntu.com/4241-1/ Third Party Advisory
https://usn.ubuntu.com/4335-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-38/ Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html Issue Tracking Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0243 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0466 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 Issue Tracking Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-02 Third Party Advisory
https://security.gentoo.org/glsa/202003-10 Third Party Advisory
https://security.gentoo.org/glsa/202003-37 Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 Third Party Advisory US Government Resource
https://usn.ubuntu.com/4241-1/ Third Party Advisory
https://usn.ubuntu.com/4335-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-38/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*
History

21 Nov 2024, 04:21

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - Issue Tracking, Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - Issue Tracking, Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2020:0243 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2020:0243 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2020:0466 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2020:0466 - Third Party Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Issue Tracking, Patch, Vendor Advisory () https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Issue Tracking, Patch, Vendor Advisory
References () https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - Third Party Advisory () https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202003-02 - Third Party Advisory () https://security.gentoo.org/glsa/202003-02 - Third Party Advisory
References () https://security.gentoo.org/glsa/202003-10 - Third Party Advisory () https://security.gentoo.org/glsa/202003-10 - Third Party Advisory
References () https://security.gentoo.org/glsa/202003-37 - Third Party Advisory () https://security.gentoo.org/glsa/202003-37 - Third Party Advisory
References () https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - Third Party Advisory, US Government Resource () https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - Third Party Advisory, US Government Resource
References () https://usn.ubuntu.com/4241-1/ - Third Party Advisory () https://usn.ubuntu.com/4241-1/ - Third Party Advisory
References () https://usn.ubuntu.com/4335-1/ - Third Party Advisory () https://usn.ubuntu.com/4335-1/ - Third Party Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-36/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-36/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-37/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-37/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-38/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-38/ - Vendor Advisory
Information

Published : 2020-01-08 20:15

Updated : 2024-11-21 04:21

NVD link : CVE-2019-11745

Mitre link : CVE-2019-11745

CVE.ORG link : CVE-2019-11745

JSON object : View

Products Affected

mozilla

  • thunderbird
  • firefox_esr
  • firefox

siemens

  • ruggedcom_rox_rx5000
  • ruggedcom_rox_rx1510_firmware
  • ruggedcom_rox_rx1511
  • ruggedcom_rox_rx1510
  • ruggedcom_rox_rx1512
  • ruggedcom_rox_rx1511_firmware
  • ruggedcom_rox_rx1500_firmware
  • ruggedcom_rox_rx1400_firmware
  • ruggedcom_rox_rx1501
  • ruggedcom_rox_rx1500
  • ruggedcom_rox_rx1400
  • ruggedcom_rox_rx1501_firmware
  • ruggedcom_rox_mx5000
  • ruggedcom_rox_rx1512_firmware
  • ruggedcom_rox_rx5000_firmware
  • ruggedcom_rox_mx5000_firmware

canonical

  • ubuntu_linux

opensuse

  • leap

redhat

  • enterprise_linux_server_aus

debian

  • debian_linux
CWE
CWE-787

Out-of-bounds Write


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024