Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esr | Nov 8, 2019 | Jul 23, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 27, 2020 | Jul 23, 2019 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jul 23, 2019 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | May 31, 2019 | May 21, 2019 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | May 23, 2019 | May 23, 2019 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-waterfoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | May 23, 2019 | May 22, 2019 | |
| Mfsa2019 13 | mozilla-firefox-upgrade-67_0 | May 22, 2019 | May 21, 2019 | |
| Mfsa2019 14 | mozilla-firefox-esr-upgrade-60_7 | May 22, 2019 | May 21, 2019 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-60_7 | May 23, 2019 | May 21, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-web-browser-firefox-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-60-7-0-11-4-10-0-1-2-0 | Jun 26, 2019 | Jun 26, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | May 24, 2019 | May 22, 2019 |
| Redhat_linux | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | May 24, 2019 | May 23, 2019 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | May 31, 2019 | May 21, 2019 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | May 22, 2019 | May 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub