CVE-2019-11745: mozilla firefox +14 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2019-11745

CVSS 8.8 · High EPSS 3,0%

Kerentanan Out-of-bounds Write pada mozilla firefox, mozilla firefox esr +13 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Rincian

Terbit di NVD: 8 Januari 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-787: Out-of-bounds Write
EPSS (30 hari): 3,0% peluang dieksploitasi; lebih tinggi dari 87,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mozilla	firefox	Semua versi sebelum 71.0
mozilla	firefox esr	Semua versi sebelum 68.3
mozilla	thunderbird	Semua versi sebelum 68.3.0
opensuse	leap	Versi 15.1
canonical	ubuntu linux	Versi 16.04
canonical	ubuntu linux	Versi 18.04
canonical	ubuntu linux	Versi 19.10
debian	debian linux	Versi 9.0
redhat	enterprise linux server aus	Versi 6.6
siemens	ruggedcom rox mx5000 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1400 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1500 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1501 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1510 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1511 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx1512 firmware	Semua versi sebelum 2.14.0
siemens	ruggedcom rox rx5000 firmware	Semua versi sebelum 2.14.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 issue tracking · patch · advisory vendor
https://www.mozilla.org/security/advisories/mfsa2019-36/ advisory vendor
https://www.mozilla.org/security/advisories/mfsa2019-37/ advisory vendor
https://www.mozilla.org/security/advisories/mfsa2019-38/ advisory vendor
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04 advisory pihak ketiga · pemerintah AS
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html mailing list · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html issue tracking · mailing list · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html mailing list · advisory pihak ketiga
https://access.redhat.com/errata/RHSA-2020:0243 advisory pihak ketiga
https://access.redhat.com/errata/RHSA-2020:0466 advisory pihak ketiga
https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202003-02 advisory pihak ketiga
https://security.gentoo.org/glsa/202003-10 advisory pihak ketiga
https://security.gentoo.org/glsa/202003-37 advisory pihak ketiga
https://usn.ubuntu.com/4241-1/ advisory pihak ketiga
https://usn.ubuntu.com/4335-1/ advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.