Vulnerability CVE-2019-11719: Information
Description
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Severity: HIGH (7.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Fixed packages
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2019-21/ |
|
| https://www.mozilla.org/security/advisories/mfsa2019-22/ |
|
| https://www.mozilla.org/security/advisories/mfsa2019-23/ |
|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1540541 |
|
| openSUSE-SU-2019:1811 | |
| openSUSE-SU-2019:1813 | |
| RHSA-2019:1951 | |
| GLSA-201908-12 | |
| GLSA-201908-20 | |
| openSUSE-SU-2019:1990 | |
| openSUSE-SU-2019:2249 | |
| openSUSE-SU-2019:2248 | |
| [debian-lts-announce] 20200929 [SECURITY] [DLA 2388-1] nss security update |