description: A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a &lt;canvas&gt; element due to an error in how same-origin policy is applied to cached image content. The resulting same-origin policy violation could allow for data theft. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
problem types: Same-origin policy violation with SVG filters and canvas to steal cross-origin images
affected:
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 69, status: affected, version: unspecified, versionType: custom
}
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 68.1, status: affected, version: unspecified, versionType: custom
lessThan: 60.9, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 60.9, status: affected, version: unspecified, versionType: custom
lessThan: 68.1, status: affected, version: unspecified, versionType: custom
}
