CVE-2019-11745

Publication date 25 November 2019

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

8.8 · High

Score breakdown

Description

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Status

Package Ubuntu Release Status
firefox 19.10 eoan
Fixed 71.0+build5-0ubuntu0.19.10.1
19.04 disco
Fixed 71.0+build5-0ubuntu0.19.04.1
18.04 LTS bionic
Fixed 71.0+build5-0ubuntu0.18.04.1
16.04 LTS xenial
Fixed 71.0+build5-0ubuntu0.16.04.1
14.04 LTS trusty Not in release
nss 19.10 eoan
Fixed 2:3.45-1ubuntu2.1
19.04 disco
Fixed 2:3.42-1ubuntu2.3
18.04 LTS bionic
Fixed 2:3.35-2ubuntu2.5
16.04 LTS xenial
Fixed 2:3.28.4-0ubuntu0.16.04.8
14.04 LTS trusty
Fixed 2:3.28.4-0ubuntu0.14.04.5+esm2
thunderbird 19.10 eoan
Fixed 1:68.4.1+build1-0ubuntu0.19.10.1
19.04 disco Ignored end of life
18.04 LTS bionic
Fixed 1:68.4.1+build1-0ubuntu0.18.04.1
16.04 LTS xenial
Fixed 1:68.7.0+build1-0ubuntu0.16.04.2
14.04 LTS trusty Not in release

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro 30-day free trial

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
nss

Severity score breakdown

Parameter Value
Base score 8.8 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-4216-2
    • Firefox vulnerabilities
    • 13 December 2019
    • USN-4216-1
    • Firefox vulnerabilities
    • 9 December 2019
    • USN-4335-1
    • Thunderbird vulnerabilities
    • 21 April 2020
    • USN-4241-1
    • Thunderbird vulnerabilities
    • 16 January 2020

Other references