NetSight
IP …
high7.5

CVE-2016-9900

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs.

Impact

External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs. This could allow for cross-domain data leakage. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 9.0
RedhatEnterprise Linux
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server
Versions 5.0, 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.4, 7.5
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0, 7.0
MozillaThunderbird
before 45.6.0
MozillaFirefox
before 50.1
before 45.6.0

Weakness classification

CWE-254

References