NetSight
IP …
medium6.1

CVE-2019-17016

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule.

Impact

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Affected products

VendorProductAffected versions
MozillaFirefox
before 72.0
MozillaFirefox Esr
before 68.4
DebianDebian Linux
Versions 8.0, 9.0, 10.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04, 19.10
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Version 7.7
RedhatEnterprise Linux Server Tus
Version 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-79

References