Home

CVE-2019-11745

Description

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.806

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (71.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (71.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox ESR (x64) (68.3.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox ESR (68.3.0)Windows
Multiple vulnerabilities fixed in Mozilla Thunderbird (68.3.0)Windows
Multiple vulnerabilities fixed in Mozilla Thunderbird (x64) (68.3.1)Windows
Multiple vulnerabilities fixed in Mozilla Thunderbird (68.3.1)Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 11.2.4Windows
Multiple Vulnerabilities are affected in IBM Cognos Analytics 12.0.3Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (71.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.3.0)Mac
Multiple vulnerabilities are fixed in Update for Mozilla Thunderbird For Mac (68.3.1)Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 68.0.1Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 68.0.1Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 70.0.1Mac
Multiple Vulnerabilities are affected in Mozilla Thunderbird for Mac 68.2.2Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac 68.3Mac
Network Security Service library (USN-4203-1) libnss3_3.35-2ubuntu2.5_i386.debLinux
Network Security Service library (USN-4203-1) libnss3_3.35-2ubuntu2.5_amd64.debLinux
Network Security Service library (USN-4203-1) libnss3_3.42-1ubuntu2.3_i386.debLinux
Network Security Service library (USN-4203-1) libnss3_3.42-1ubuntu2.3_amd64.debLinux
Network Security Service library (USN-4203-1) libnss3_3.45-1ubuntu2.1_i386.debLinux
Network Security Service library (USN-4203-1) libnss3_3.45-1ubuntu2.1_amd64.debLinux
Network Security Service library (USN-4203-1) libnss3_3.28.4-0ubuntu0.16.04.8_i386.debLinux
Network Security Service library (USN-4203-1) libnss3_3.28.4-0ubuntu0.16.04.8_amd64.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.19.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.19.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source web browser (USN-4216-1) firefox_71.0+build5-0ubuntu0.19.10.1_amd64.debLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-3.44.0-6.el6_10.i686.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-3.44.0-6.el6_10.x86_64.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-devel-3.44.0-6.el6_10.i686.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-devel-3.44.0-6.el6_10.x86_64.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-freebl-3.44.0-6.el6_10.i686.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-freebl-3.44.0-6.el6_10.x86_64.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-freebl-devel-3.44.0-6.el6_10.i686.rpmLinux
(RHSA-2019:4152) nss-softokn security update nss-softokn-freebl-devel-3.44.0-6.el6_10.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-3.44.0-7.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-3.44.0-7.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-devel-3.44.0-7.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-devel-3.44.0-7.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-pkcs11-devel-3.44.0-7.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-pkcs11-devel-3.44.0-7.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-3.44.0-8.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-3.44.0-8.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-devel-3.44.0-8.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-devel-3.44.0-8.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-freebl-3.44.0-8.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-freebl-3.44.0-8.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-freebl-devel-3.44.0-8.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-softokn-freebl-devel-3.44.0-8.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-sysinit-3.44.0-7.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-tools-3.44.0-7.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-util-3.44.0-4.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-util-3.44.0-4.el7_7.x86_64.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-util-devel-3.44.0-4.el7_7.i686.rpmLinux
(RHSA-2019:4190) nss, nss-softokn, nss-util security update nss-util-devel-3.44.0-4.el7_7.x86_64.rpmLinux
SUSE-SU-2019:3347-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-68.3.0-109.98.1.x86_64.rpmLinux
SUSE-SU-2019:3347-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-debuginfo-68.3.0-109.98.1.x86_64.rpmLinux
SUSE-SU-2019:3347-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-debugsource-68.3.0-109.98.1.x86_64.rpmLinux
SUSE-SU-2019:3347-1(SUSE Linux Enterprise Desktop 12-SP4 ) MozillaFirefox-translations-common-68.3.0-109.98.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libfreebl3-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libfreebl3-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libfreebl3-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libfreebl3-debuginfo-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libsoftokn3-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libsoftokn3-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libsoftokn3-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) libsoftokn3-debuginfo-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nspr-4.23-19.12.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nspr-32bit-4.23-19.12.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nspr-debuginfo-4.23-19.12.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nspr-debuginfo-32bit-4.23-19.12.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nspr-debugsource-4.23-19.12.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-certs-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-certs-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-certs-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-certs-debuginfo-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-debuginfo-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-debugsource-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-sysinit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-sysinit-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-sysinit-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-sysinit-debuginfo-32bit-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-tools-3.47.1-58.34.1.x86_64.rpmLinux
SUSE-SU-2020:0088-1(SUSE Linux Enterprise Desktop 12-SP4 ) mozilla-nss-tools-debuginfo-3.47.1-58.34.1.x86_64.rpmLinux
Mozilla Open Source mail and newsgroup client (USN-4241-1) thunderbird_68.4.1+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4241-1) thunderbird_68.4.1+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4241-1) thunderbird_68.4.1+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4241-1) thunderbird_68.4.1+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4335-1) thunderbird_68.7.0+build1-0ubuntu0.16.04.2_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4335-1) thunderbird_68.7.0+build1-0ubuntu0.16.04.2_amd64.debLinux
(RHSA-2019:4114) nss security update nss-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-debugsource-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-debugsource-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-devel-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-devel-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-freebl-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-freebl-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-freebl-devel-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-softokn-freebl-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-sysinit-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-tools-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-util-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-util-3.44.0-9.el8_1.x86_64.rpmLinux
(RHSA-2019:4114) nss security update nss-util-devel-3.44.0-9.el8_1.i686.rpmLinux
(RHSA-2019:4114) nss security update nss-util-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-devel-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-devel-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-freebl-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-freebl-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-freebl-devel-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-softokn-freebl-devel-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-sysinit-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-tools-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-util-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-util-3.44.0-9.el8_1.x86_64.rpmLinux
(CESA-2019:4114) nss security update nss-util-devel-3.44.0-9.el8_1.i686.rpmLinux
(CESA-2019:4114) nss security update nss-util-devel-3.44.0-9.el8_1.x86_64.rpmLinux
Out-of-bounds Write Vulnerability (CVE-2019-11745)NCM

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-312011Mozilla Firefox (x64) (71.0)
PATCH-312010Mozilla Firefox (71.0)
PATCH-312026Mozilla Firefox ESR (x64) (68.3.0)
PATCH-312021Mozilla Firefox ESR (68.3.0)
PATCH-312050Mozilla Thunderbird (68.3.0)
PATCH-312247Mozilla Thunderbird (x64) (68.3.1)
PATCH-312246Mozilla Thunderbird (68.3.1)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234