CVE-2019-11745

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-11745
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html Issue Tracking Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0243 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0466 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 Issue Tracking Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-02 Third Party Advisory
https://security.gentoo.org/glsa/202003-10 Third Party Advisory
https://security.gentoo.org/glsa/202003-37 Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 Third Party Advisory US Government Resource
https://usn.ubuntu.com/4241-1/ Third Party Advisory
https://usn.ubuntu.com/4335-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-38/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*
History

19 Feb 2021, 17:22

Type Values Removed Values Added
CPE cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
References (UBUNTU) https://usn.ubuntu.com/4241-1/ - (UBUNTU) https://usn.ubuntu.com/4241-1/ - Third Party Advisory
References (CONFIRM) https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Permissions Required (CONFIRM) https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Issue Tracking, Patch, Vendor Advisory
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-10 - (GENTOO) https://security.gentoo.org/glsa/202003-10 - Third Party Advisory
References (MLIST) https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - (MLIST) https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - Mailing List, Third Party Advisory
References (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - Third Party Advisory, US Government Resource
References (REDHAT) https://access.redhat.com/errata/RHSA-2020:0243 - (REDHAT) https://access.redhat.com/errata/RHSA-2020:0243 - Third Party Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2020:0466 - (REDHAT) https://access.redhat.com/errata/RHSA-2020:0466 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4335-1/ - (UBUNTU) https://usn.ubuntu.com/4335-1/ - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-37 - (GENTOO) https://security.gentoo.org/glsa/202003-37 - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-02 - (GENTOO) https://security.gentoo.org/glsa/202003-02 - Third Party Advisory

12 Feb 2021, 07:15

Type Values Removed Values Added
References
  • (MISC) https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 -

09 Feb 2021, 14:15

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf -
Information

Published : 2020-01-08 20:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-11745

Mitre link : CVE-2019-11745

CVE.ORG link : CVE-2019-11745

JSON object : View

Products Affected

mozilla

  • firefox_esr
  • firefox
  • thunderbird

siemens

  • ruggedcom_rox_rx1400
  • ruggedcom_rox_rx5000_firmware
  • ruggedcom_rox_rx1500_firmware
  • ruggedcom_rox_rx1501_firmware
  • ruggedcom_rox_mx5000_firmware
  • ruggedcom_rox_rx1512
  • ruggedcom_rox_rx1510_firmware
  • ruggedcom_rox_rx1510
  • ruggedcom_rox_rx1512_firmware
  • ruggedcom_rox_rx1511
  • ruggedcom_rox_rx1501
  • ruggedcom_rox_mx5000
  • ruggedcom_rox_rx1511_firmware
  • ruggedcom_rox_rx1500
  • ruggedcom_rox_rx1400_firmware
  • ruggedcom_rox_rx5000

canonical

  • ubuntu_linux

redhat

  • enterprise_linux_server_aus

opensuse

  • leap

debian

  • debian_linux
CWE
CWE-787

Out-of-bounds Write