CVE-2019-11729

Name	CVE-2019-11729
Description	Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into memory and used. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-1857-1, DLA-2388-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
firefox (PTS)	sid	133.0.3-1	fixed
firefox-esr (PTS)	bullseye	115.14.0esr-1~deb11u1	fixed
	bullseye (security)	128.5.0esr-1~deb11u1	fixed
	bookworm	128.3.1esr-1~deb12u1	fixed
	bookworm (security)	128.5.0esr-1~deb12u1	fixed
	trixie	128.5.0esr-1	fixed
	sid	128.5.1esr-1	fixed
nss (PTS)	bullseye	2:3.61-1+deb11u3	fixed
	bullseye (security)	2:3.61-1+deb11u4	fixed
	bookworm	2:3.87.1-1	fixed
	bookworm (security)	2:3.87.1-1+deb12u1	fixed
	sid, trixie	2:3.106-1	fixed
thunderbird (PTS)	bullseye	1:115.12.0-1~deb11u1	fixed
	bullseye (security)	1:128.5.0esr-1~deb11u1	fixed
	bookworm	1:115.16.0esr-1~deb12u1	fixed
	bookworm (security)	1:128.5.0esr-1~deb12u1	fixed
	sid, trixie	1:128.5.2esr-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
firefox	source	(unstable)	68.0-1	unimportant
firefox-esr	source	stretch	60.8.0esr-1~deb9u1
firefox-esr	source	buster	60.8.0esr-1~deb10u1
firefox-esr	source	(unstable)	60.8.0esr-1	unimportant
nss	source	jessie	2:3.26-1+debu8u5		DLA-1857-1
nss	source	stretch	2:3.26.2-1.1+deb9u2		DLA-2388-1
nss	source	buster	2:3.42.1-1+deb10u1
nss	source	(unstable)	2:3.45-1
thunderbird	source	stretch	1:60.8.0-1~deb9u1
thunderbird	source	buster	1:60.8.0-1~deb10u1
thunderbird	source	(unstable)	1:60.8.0-1	unimportant

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11729
https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11729
https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/#CVE-2019-11729
https://hg.mozilla.org/projects/nss/rev/dabfe1160c682b4d1d19c5a7a13ab3828bb9d37f
https://hg.mozilla.org/projects/nss/rev/ebc93d6daeaa9001d31fd18b5199779da99ae9aa
firefox-esr in older suites than buster use the embedded copy and thus issue
is just fixed by updating firefox-esr to 60.8.0. For the others an update to
src:nss is needed as firefox-esr uses the system library.