CVE-2019-17000
08.01.2020, 21:15
An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs. This vulnerability affects Firefox < 70.
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | 𝑥 < 70.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| firefox |
| ||||||||||||||||||||||||||||
| mozjs38 |
| ||||||||||||||||||||||||||||
| mozjs52 |
| ||||||||||||||||||||||||||||
| mozjs60 |
|