CVE-2019-11745

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-11745
When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html Issue Tracking Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0243 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0466 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 Issue Tracking Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-02 Third Party Advisory
https://security.gentoo.org/glsa/202003-10 Third Party Advisory
https://security.gentoo.org/glsa/202003-37 Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 Third Party Advisory US Government Resource
https://usn.ubuntu.com/4241-1/ Third Party Advisory
https://usn.ubuntu.com/4335-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-38/ Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html Issue Tracking Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0243 Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0466 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 Issue Tracking Patch Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202003-02 Third Party Advisory
https://security.gentoo.org/glsa/202003-10 Third Party Advisory
https://security.gentoo.org/glsa/202003-37 Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 Third Party Advisory US Government Resource
https://usn.ubuntu.com/4241-1/ Third Party Advisory
https://usn.ubuntu.com/4335-1/ Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-38/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*
History

21 Nov 2024, 04:21

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - Issue Tracking, Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html - Issue Tracking, Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2020:0243 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2020:0243 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2020:0466 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2020:0466 - Third Party Advisory
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Issue Tracking, Patch, Vendor Advisory () https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 - Issue Tracking, Patch, Vendor Advisory
References () https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - Third Party Advisory () https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202003-02 - Third Party Advisory () https://security.gentoo.org/glsa/202003-02 - Third Party Advisory
References () https://security.gentoo.org/glsa/202003-10 - Third Party Advisory () https://security.gentoo.org/glsa/202003-10 - Third Party Advisory
References () https://security.gentoo.org/glsa/202003-37 - Third Party Advisory () https://security.gentoo.org/glsa/202003-37 - Third Party Advisory
References () https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - Third Party Advisory, US Government Resource () https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 - Third Party Advisory, US Government Resource
References () https://usn.ubuntu.com/4241-1/ - Third Party Advisory () https://usn.ubuntu.com/4241-1/ - Third Party Advisory
References () https://usn.ubuntu.com/4335-1/ - Third Party Advisory () https://usn.ubuntu.com/4335-1/ - Third Party Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-36/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-36/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-37/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-37/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2019-38/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2019-38/ - Vendor Advisory
Information

Published : 2020-01-08 20:15

Updated : 2024-11-21 04:21

NVD link : CVE-2019-11745

Mitre link : CVE-2019-11745

CVE.ORG link : CVE-2019-11745

JSON object : View

Products Affected

siemens

  • ruggedcom_rox_rx1510_firmware
  • ruggedcom_rox_rx1510
  • ruggedcom_rox_rx1501_firmware
  • ruggedcom_rox_rx1511_firmware
  • ruggedcom_rox_rx5000_firmware
  • ruggedcom_rox_rx1512_firmware
  • ruggedcom_rox_rx5000
  • ruggedcom_rox_rx1511
  • ruggedcom_rox_rx1400
  • ruggedcom_rox_rx1512
  • ruggedcom_rox_rx1501
  • ruggedcom_rox_rx1400_firmware
  • ruggedcom_rox_mx5000_firmware
  • ruggedcom_rox_rx1500
  • ruggedcom_rox_rx1500_firmware
  • ruggedcom_rox_mx5000

debian

  • debian_linux

mozilla

  • firefox
  • thunderbird
  • firefox_esr

redhat

  • enterprise_linux_server_aus

opensuse

  • leap

canonical

  • ubuntu_linux
CWE
CWE-787

Out-of-bounds Write