cve/2019/CVE-2019-17016.md

CVE-2019-17016

Description

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

POC

Reference

• http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
• http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1599181
• https://bugzilla.mozilla.org/show_bug.cgi?id=1599181

Github

• https://github.com/ARPSyndicate/cvemon