CVE-2019-11745

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Updated nss packages fix security vulnerability:

Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745).

Also, rootcerts has been updated to 20191126.00

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

• New: Message display toolbar action WebExtension API (bmo#1531597)
• New: Navigation buttons are now available in content tabs (bmo#787683)
• Fixed an issue where write window was not always correct (bmo#1593280)
• Fixed toolbar issues (bmo#1584160)
• Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
• Fixed an issue with scam link confirmation panel (bmo#1596413)
• Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
• Fixed issues with calendar (bmo#1588516)
• Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)

This update was imported from the SUSE:SLE-15:Update update project.

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to NSS 3.47.1:

Security issues fixed:

• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527).
• CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322).

mozilla-nspr was updated to version 4.23:

• Whitespace in C files was cleaned up and no longer uses tab characters for indenting.

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:

Update Firefox Extended Support Release to 68.3.0 ESR (MFSA 2019-37 / bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Use-after-free in worker destruction (bmo#1546331).
• CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156).
• CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher (bmo#1586176).
• CVE-2019-17009: Updater temporary files accessible to unprivileged processes (bmo#1510494).
• CVE-2019-17010: Use-after-free when performing device orientation checks (bmo#1581084).
• CVE-2019-17005: Buffer overflow in plain text serializer (bmo#1584170).
• CVE-2019-17011: Use-after-free when retrieving a document in antitracking (bmo#1591334).
• CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502).

Update mozilla-nss to version 3.47.1 (bsc#1158527):

Security issues fixed:

• CVE-2019-11745: EncryptUpdate should use maxout, not block size.

Bug fixes:

• Fix a crash that could be caused by client certificates during startup (bmo#1590495, bsc#1158527)
• Fix compile-time warnings from uninitialized variables in a perl script (bmo#1589810)
• Support AES HW acceleration on ARMv8 (bmo#1152625)
• Allow per-socket run-time ordering of the cipher suites presented in ClientHello (bmo#1267894)
• Add CMAC to FreeBL and PKCS #11 libraries (bmo#1570501)
• Remove arbitrary HKDF output limit by allocating space as needed (bmo#1577953)

Update mozilla-nspr to version 4.23:

Bug fixes:

• fixed a build failure that was introduced in 4.22
• correctness fix for Win64 socket polling
• whitespace in C files was cleaned up and no longer uses tab characters for indenting
• added support for the ARC architecture
• removed support for the following platforms: OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
• correctness and build fixes

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

• New: Message display toolbar action WebExtension API (bmo#1531597)
• New: Navigation buttons are now available in content tabs (bmo#787683)
• Fixed an issue where write window was not always correct (bmo#1593280)
• Fixed toolbar issues (bmo#1584160)
• Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
• Fixed an issue with scam link confirmation panel (bmo#1596413)
• Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
• Fixed issues with calendar (bmo#1588516)
• Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to NSS 3.47.1:

Security issues fixed:

• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527).
• CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322).

mozilla-nspr was updated to version 4.23:

• Whitespace in C files was cleaned up and no longer uses tab characters for indenting.

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to NSS 3.47.1:

Security issues fixed:

• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• CVE-2019-11745: EncryptUpdate should use maxout, not block size (bsc#1158527).
• CVE-2019-11727: Fixed vulnerability sign CertificateVerify with PKCS#1 v1.5 signatures issue (bsc#1141322).

mozilla-nspr was updated to version 4.23:

• Whitespace in C files was cleaned up and no longer uses tab characters for indenting.

This update for mozilla-nspr, mozilla-nss fixes the following issues:

mozilla-nss was updated to version 3.53.1

• CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate
• CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).
• CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).
• CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).
• CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages.
• Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).
• Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes

mozilla-nspr was updated to version 4.25.

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

USN-4203-1 fixed a vulnerability in NSS. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code.

USN-4216-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubuntu 16.04 LTS.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code.

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit this to spoof the message author. (CVE-2019-11755)

A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-15903)

It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)

Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)

It was discovered that if a user saved passwords before Thunderbird 60 and then later set a primary password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)

It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)