CVE-2019-11729: Buffer Overflow

Published Jul 9, 2019
·
Updated

Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used.

Other sources

Mozilla Firefox is vulnerable to a denial of service, caused by the improperly validation of empty or malformed p256-ECDH public keys before being copied into memory and used. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to cause the browser to crash.

— IBM

Affected Software

16 affected componentsFixes available
redhat/nss<0:3.44.0-7.el7_7
0:3.44.0-7.el7_7
redhat/nss-softokn<0:3.44.0-8.el7_7
0:3.44.0-8.el7_7
redhat/nss-util<0:3.44.0-4.el7_7
0:3.44.0-4.el7_7
redhat/nspr<0:4.21.0-2.el8_0
0:4.21.0-2.el8_0
redhat/nss<0:3.44.0-7.el8_0
0:3.44.0-7.el8_0
redhat/nss<3.45
3.45
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
Mozilla Thunderbird<60.8
60.8
Mozilla Thunderbird<68
68
Mozilla Firefox<68.0
Mozilla Firefox ESR<60.8.0
Mozilla Thunderbird<60.8.0
Mozilla Firefox<68
68
Mozilla Firefox ESR<60.8
60.8
Mozilla Firefox<60.8.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/nss to a version that resolves this vulnerability.

    Fixed in 0:3.44.0-7.el7_7
  2. Upgrade

    Upgrade redhat/nss-softokn to a version that resolves this vulnerability.

    Fixed in 0:3.44.0-8.el7_7
  3. Upgrade

    Upgrade redhat/nss-util to a version that resolves this vulnerability.

    Fixed in 0:3.44.0-4.el7_7
  4. Upgrade

    Upgrade redhat/nspr to a version that resolves this vulnerability.

    Fixed in 0:4.21.0-2.el8_0
  5. Upgrade

    Upgrade redhat/nss to a version that resolves this vulnerability.

    Fixed in 0:3.44.0-7.el8_0
  6. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 60.8
  7. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 68
  8. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 68
  9. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 60.8
  10. Upgrade

    Upgrade redhat/nss to a version that resolves this vulnerability.

    Fixed in 3.45

Event History

Jul 9, 2019
CVE Published
12:00 AM
Jul 10, 2019
Data Sourced
via Red Hat·12:27 AM
DescriptionSeverityAffected Software
Jul 23, 2019
CVE Published
via MITRE·01:16 PM
Data Sourced
via MITRE·01:16 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2019-11729?

CVE-2019-11729 is a vulnerability in Mozilla Firefox that can be exploited to cause a denial of service.

2

How does CVE-2019-11729 work?

The vulnerability occurs when empty or malformed p256-ECDH public keys are not properly validated and copied into memory, leading to a segmentation fault.

3

What is the severity of CVE-2019-11729?

CVE-2019-11729 has a severity rating of 7.5 (high).

4

Which software versions are affected by CVE-2019-11729?

Mozilla Firefox versions up to and including 68.0, Mozilla Firefox ESR versions up to and including 60.8.0, and Mozilla Thunderbird versions up to and including 60.8.0 are affected.

5

How can I fix CVE-2019-11729?

Update your Mozilla Firefox, Mozilla Firefox ESR, and Mozilla Thunderbird to versions 68.0.1, 60.8.1, and 68.0.1 respectively.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203