A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Nov 8, 2019 | Sep 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Apr 27, 2020 | Sep 27, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2019 |
| Centos_linux | — | Upgrade thunderbird-debuginfoUpgrade firefox-debugsourceUpgrade firefox-debuginfoUpgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade firefox | Sep 5, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Sep 9, 2019 | Sep 9, 2019 |
| Freebsd | — | Upgrade seamonkeyUpgrade linux-firefoxUpgrade thunderbirdUpgrade firefoxUpgrade libxulUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade linux-seamonkeyUpgrade waterfox | Sep 4, 2019 | Sep 3, 2019 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Nov 25, 2019 | Sep 27, 2019 |
| Mfsa2019 25 | — | Upgrade to Mozilla Firefox version 69.0 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 26 | — | Upgrade to Mozilla Firefox ESR version 68.1 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 27 | — | Upgrade to Mozilla Firefox ESR version 60.9 | Sep 4, 2019 | Sep 3, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.1 | Sep 16, 2021 | Sep 27, 2019 |
| Oracle Solaris | — | Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade web/browser/firefox to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Sep 27, 2019 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Sep 11, 2019 | Sep 3, 2019 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade firefox-debuginfoUpgrade firefox-debugsourceNo solution existsUpgrade firefoxUpgrade thunderbird-debuginfo | Sep 5, 2019 | Sep 4, 2019 |
| Suse | — | Upgrade enigmailUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade MozillaThunderbird-buildsymbolsUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade MozillaThunderbirdUpgrade libfirefox-gthread-2_0-0Upgrade libsoftokn3-32bitUpgrade MozillaThunderbird-translations-otherUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-langUpgrade firefox-libcairo2Upgrade firefox-libatk-1_0-0Upgrade MozillaFirefox-develUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-toolsUpgrade firefox-gio-branding-upstreamUpgrade mozilla-nssUpgrade libfreebl3Upgrade mozillafirefox-branding-sleUpgrade MozillaFirefoxUpgrade firefox-libcairo-gobject2Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-glib2-toolsUpgrade mozillafirefox-buildsymbolsUpgrade firefox-libffi4Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-atk-langUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-libffi7Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozillafirefox-branding-upstreamUpgrade mozilla-nss-32bitUpgrade libfirefox-gio-2_0-0Upgrade libfreebl3-32bitUpgrade firefox-libpango-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade MozillaThunderbird-translations-common | Sep 18, 2019 | Sep 3, 2019 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Sep 5, 2019 | Sep 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub