Firefox esr 17.0 code#

Firefox esr 17.0 code#

Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.Ī heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.Ī use-after-free vulnerability in SVG Animation has been discovered. This could allow for cross-domain data leakage. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.Įxternal resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of 'data:' URLs. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.Ī potential use-after-free found through fuzzing during DOM manipulation of SVG content.

This violates same-origin policy and leads to information disclosure. This can be used to extract history information and read text values across domains. Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This vulnerability affects Firefox < 52 and Thunderbird < 52. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.Ī buffer overflow read during SVG filter color value operations, resulting in data exposure. This results in a crash and also allows for otherwise inaccessible memory being copied into SVG graphic content, which could then displayed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.Īn out-of-bounds read while processing SVG content in 'ConvolvePixel'. This results in a potentially exploitable crash.

This vulnerability affects Firefox < 55.Ī buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This vulnerability affects Firefox < 57.Ī use-after-free vulnerability can occur when the layer manager is freed too early when rendering specific SVG content, resulting in a potentially exploitable crash. This vulnerability affects Firefox ' tags can use '' tags within the SVG data to set cookies for that page.

In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS.