CVE-2019-11719

Name	CVE-2019-11719
Description	When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1857-1, DLA-2388-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	117.0.1-1	fixed
firefox-esr (PTS)	buster	91.12.0esr-1~deb10u1	fixed
	buster (security)	102.15.1esr-1~deb10u1	fixed
	bullseye	102.10.0esr-1~deb11u1	fixed
	bullseye (security)	102.15.1esr-1~deb11u1	fixed
	bookworm	102.13.0esr-1~deb12u1	fixed
	bookworm (security)	102.15.1esr-1~deb12u1	fixed
	sid, trixie	115.2.1esr-1	fixed
nss (PTS)	buster	2:3.42.1-1+deb10u5	fixed
	buster (security)	2:3.42.1-1+deb10u6	fixed
	bullseye (security), bullseye	2:3.61-1+deb11u3	fixed
	bookworm	2:3.87.1-1	fixed
	trixie	2:3.92-1	fixed
	sid	2:3.93-1	fixed
thunderbird (PTS)	buster	1:91.12.0-1~deb10u1	fixed
	buster (security)	1:102.15.1-1~deb10u1	fixed
	bullseye	1:102.10.0-1~deb11u1	fixed
	bullseye (security)	1:102.15.1-1~deb11u1	fixed
	bookworm	1:102.13.0-1~deb12u1	fixed
	bookworm (security)	1:102.15.1-1~deb12u1	fixed
	sid, trixie	1:115.2.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	68.0-1	unimportant
firefox-esr	source	stretch	60.8.0esr-1~deb9u1
firefox-esr	source	buster	60.8.0esr-1~deb10u1
firefox-esr	source	(unstable)	60.8.0esr-1	unimportant
nss	source	jessie	2:3.26-1+debu8u5		DLA-1857-1
nss	source	stretch	2:3.26.2-1.1+deb9u2		DLA-2388-1
nss	source	buster	2:3.42.1-1+deb10u1
nss	source	(unstable)	2:3.45-1
thunderbird	source	stretch	1:60.8.0-1~deb9u1
thunderbird	source	buster	1:60.8.0-1~deb10u1
thunderbird	source	(unstable)	1:60.8.0-1	unimportant

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11719
https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/#CVE-2019-11719
https://hg.mozilla.org/projects/nss/rev/6cfb54d262d030783137aa6478b45ecb3cbfc624
firefox-esr in older suites than buster use the embedded copy and thus issue
is just fixed by updating firefox-esr to 60.8.0. For the others an update to
src:nss is needed as firefox-esr uses the system library.