A use-after-free was found in Mozilla nss, related to PK11 session handling. An attacker could this to execute arbitrary code with the permissions of user running the application (compiled with nss). This flaw is difficult to trigger (even impossible as per upstream)
Acknowledgments: Name: the Mozilla project
External References: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes
Upstream patch: https://hg.mozilla.org/projects/nss/rev/5619cbbca3db5f583a888181ec024069a46087aa Upstream bug (currently private): https://bugzilla.mozilla.org/show_bug.cgi?id=1508776
Statement: This flaw was fixed in upstream nss-3.47. Exploitation of this flaw is difficult and even impossible in most cases.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:3280 https://access.redhat.com/errata/RHSA-2020:3280
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-11756
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4076 https://access.redhat.com/errata/RHSA-2020:4076
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.4 Advanced Update Support Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions Red Hat Enterprise Linux 7.4 Telco Extended Update Support Via RHSA-2021:0758 https://access.redhat.com/errata/RHSA-2021:0758
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.6 Extended Update Support Via RHSA-2021:0876 https://access.redhat.com/errata/RHSA-2021:0876
This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Extended Update Support Via RHSA-2021:1026 https://access.redhat.com/errata/RHSA-2021:1026