CVE-2019-11719

Name	CVE-2019-11719
Description	When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1857-1, DLA-2388-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	138.0.1-1	fixed
firefox-esr (PTS)	bullseye	115.14.0esr-1~deb11u1	fixed
	bullseye (security)	128.9.0esr-1~deb11u1	fixed
	bookworm	128.8.0esr-1~deb12u1	fixed
	bookworm (security)	128.10.0esr-1~deb12u1	fixed
	trixie	128.9.0esr-2	fixed
	sid	128.10.0esr-1	fixed
nss (PTS)	bullseye	2:3.61-1+deb11u3	fixed
	bullseye (security)	2:3.61-1+deb11u4	fixed
	bookworm, bookworm (security)	2:3.87.1-1+deb12u1	fixed
	sid, trixie	2:3.110-1	fixed
thunderbird (PTS)	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.10.0esr-1~deb11u1	fixed
	bookworm	1:128.8.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.10.0esr-1~deb12u1	fixed
	trixie	1:128.9.0esr-1	fixed
	sid	1:128.10.0esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	68.0-1	unimportant
firefox-esr	source	stretch	60.8.0esr-1~deb9u1
firefox-esr	source	buster	60.8.0esr-1~deb10u1
firefox-esr	source	(unstable)	60.8.0esr-1	unimportant
nss	source	jessie	2:3.26-1+debu8u5		DLA-1857-1
nss	source	stretch	2:3.26.2-1.1+deb9u2		DLA-2388-1
nss	source	buster	2:3.42.1-1+deb10u1
nss	source	(unstable)	2:3.45-1
thunderbird	source	stretch	1:60.8.0-1~deb9u1
thunderbird	source	buster	1:60.8.0-1~deb10u1
thunderbird	source	(unstable)	1:60.8.0-1	unimportant

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/#CVE-2019-11719
https://hg.mozilla.org/projects/nss/rev/6cfb54d262d030783137aa6478b45ecb3cbfc624
firefox-esr in older suites than buster use the embedded copy and thus issue
is just fixed by updating firefox-esr to 60.8.0. For the others an update to
src:nss is needed as firefox-esr uses the system library.