NetSight
IP …
medium6.1

CVE-2016-9895

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript.

Impact

Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 9.0
RedhatEnterprise Linux
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.4, 7.5
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0, 7.0
MozillaThunderbird
before 45.6.0
MozillaFirefox
before 50.1
before 45.6.0

Weakness classification

CWE-254

References