Описание
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| firefox | fixed | 68.0-1 | package | |
| firefox-esr | fixed | 60.8.0esr-1 | package | |
| firefox-esr | fixed | 60.8.0esr-1~deb10u1 | buster | package |
| firefox-esr | fixed | 60.8.0esr-1~deb9u1 | stretch | package |
| thunderbird | fixed | 1:60.8.0-1 | package | |
| thunderbird | fixed | 1:60.8.0-1~deb10u1 | buster | package |
| thunderbird | fixed | 1:60.8.0-1~deb9u1 | stretch | package |
| nss | fixed | 2:3.45-1 | package | |
| nss | fixed | 2:3.42.1-1+deb10u1 | buster | package |
Примечания
https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729
https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729
https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/#CVE-2019-11729
https://hg.mozilla.org/projects/nss/rev/dabfe1160c682b4d1d19c5a7a13ab3828bb9d37f
https://hg.mozilla.org/projects/nss/rev/ebc93d6daeaa9001d31fd18b5199779da99ae9aa
firefox-esr in older suites than buster use the embedded copy and thus issue
is just fixed by updating firefox-esr to 60.8.0. For the others an update to
src:nss is needed as firefox-esr uses the system library.
EPSS
Связанные уязвимости
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Уязвимость функции формирования открытых ключей p256-ECDH браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю вызвать отказ в обслуживании
EPSS