A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Nov 8, 2019 | Sep 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Apr 27, 2020 | Sep 27, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2019 |
| Centos_linux | — | Upgrade firefox-debugsourceUpgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade firefoxUpgrade thunderbirdUpgrade thunderbird-debugsource | Sep 5, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Sep 9, 2019 | Sep 9, 2019 |
| Freebsd | — | Upgrade firefoxUpgrade libxulUpgrade seamonkeyUpgrade thunderbirdUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade firefox-esrUpgrade linux-thunderbirdUpgrade waterfox | Sep 4, 2019 | Sep 3, 2019 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Nov 25, 2019 | Sep 27, 2019 |
| Mfsa2019 25 | — | Upgrade to Mozilla Firefox version 69.0 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 26 | — | Upgrade to Mozilla Firefox ESR version 68.1 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 27 | — | Upgrade to Mozilla Firefox ESR version 60.9 | Sep 4, 2019 | Sep 3, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.1 | Sep 16, 2021 | Sep 27, 2019 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4Upgrade web/browser/firefox to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Sep 27, 2019 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbird | Sep 11, 2019 | Sep 3, 2019 |
| Redhat_linux | — | No solution existsUpgrade firefoxUpgrade thunderbird-debuginfoUpgrade firefox-debugsourceUpgrade thunderbirdUpgrade firefox-debuginfoUpgrade thunderbird-debugsource | Sep 5, 2019 | Sep 4, 2019 |
| Suse | — | Upgrade mozillathunderbirdUpgrade mozillafirefox-buildsymbolsUpgrade mozillafirefox-branding-sleUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-certsUpgrade mozillafirefox-branding-sledUpgrade libfreebl3Upgrade libfreebl3-32bitUpgrade mozillafirefoxUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-glib2-toolsUpgrade mozilla-nssUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gio-branding-upstreamUpgrade mozillafirefox-branding-upstreamUpgrade firefox-atk-langUpgrade mozilla-nss-certs-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nsprUpgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillathunderbird-translations-otherUpgrade firefox-libffi4Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-glib-2_0-0Upgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-langUpgrade mozilla-nss-develUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-langUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade firefox-libcairo2Upgrade firefox-libatk-1_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-vietnameseUpgrade libfirefox-gthread-2_0-0Upgrade mozillathunderbird-translations-commonUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-thaiUpgrade enigmailUpgrade mozillafirefox-translations-commonUpgrade MozillaThunderbird-buildsymbolsUpgrade mozillafirefox-develUpgrade firefox-libharfbuzz0 | Sep 18, 2019 | Sep 3, 2019 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Sep 5, 2019 | Sep 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub