A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Nov 8, 2019 | Sep 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Apr 27, 2020 | Sep 27, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2019 |
| Centos_linux | — | Upgrade thunderbird-debugsourceUpgrade firefoxUpgrade thunderbirdUpgrade firefox-debuginfoUpgrade firefox-debugsourceUpgrade thunderbird-debuginfo | Sep 5, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Sep 9, 2019 | Sep 9, 2019 |
| Freebsd | — | Upgrade firefox-esrUpgrade waterfoxUpgrade linux-seamonkeyUpgrade linux-thunderbirdUpgrade thunderbirdUpgrade linux-firefoxUpgrade libxulUpgrade firefoxUpgrade seamonkey | Sep 4, 2019 | Sep 3, 2019 |
| Gentoo Linux | — | Upgrade www-client/firefox-bin.Upgrade www-client/firefox. | Nov 25, 2019 | Sep 27, 2019 |
| Mfsa2019 25 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 69.0 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 26 | — | Upgrade to Mozilla Firefox ESR version 68.1Upgrade to the latest version of Mozilla Firefox | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 27 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 60.9 | Sep 4, 2019 | Sep 3, 2019 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 68.1 | Sep 16, 2021 | Sep 27, 2019 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Sep 27, 2019 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbird | Sep 11, 2019 | Sep 3, 2019 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade firefox-debuginfoUpgrade thunderbirdNo solution existsUpgrade firefox-debugsourceUpgrade thunderbird-debuginfoUpgrade firefox | Sep 5, 2019 | Sep 4, 2019 |
| Suse | — | Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade mozillafirefox-branding-sleUpgrade mozilla-nss-certs-32bitUpgrade mozillafirefox-buildsymbolsUpgrade firefox-atk-langUpgrade firefox-libcairo-gobject2Upgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-glib2-toolsUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-glib-2_0-0Upgrade MozillaThunderbird-translations-commonUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gio-2_0-0Upgrade mozillafirefox-branding-upstreamUpgrade mozilla-nsprUpgrade libfreebl3Upgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-libcairo2Upgrade firefox-gtk3-langUpgrade mozilla-nspr-develUpgrade libsoftokn3-32bitUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-buildsymbolsUpgrade enigmailUpgrade firefox-libharfbuzz0Upgrade MozillaThunderbird-translations-otherUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-develUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-translations-otherUpgrade firefox-glib2-langUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-ximUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-toolsUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-tools | Sep 18, 2019 | Sep 3, 2019 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Sep 5, 2019 | Sep 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub