CVE-2019-9797

Published: Apr 26, 2019Modified: Jun 17, 2026

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.

Affected (1)

Products: Mozilla: Firefox

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 66.0

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (38)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1265

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1267

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1269

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1308

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1309

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2019:1310

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1528909

Source: security@mozilla.org

Issue TrackingPermissions RequiredVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html

Source: security@mozilla.org

https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html

Source: security@mozilla.org

https://seclists.org/bugtraq/2019/May/56

Source: security@mozilla.org

https://seclists.org/bugtraq/2019/May/59

Source: security@mozilla.org

https://seclists.org/bugtraq/2019/May/67

Source: security@mozilla.org

https://usn.ubuntu.com/3997-1/

Source: security@mozilla.org

https://www.debian.org/security/2019/dsa-4448

Source: security@mozilla.org

https://www.debian.org/security/2019/dsa-4451

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2019-07/

Source: security@mozilla.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1265

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1267

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1269

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1308

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1309

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2019:1310

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=1528909

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPermissions RequiredVendor Advisory

https://lists.debian.org/debian-lts-announce/2019/05/msg00032.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/May/56

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/May/59

Source: af854a3a-2127-422b-91ae-364da2661108

https://seclists.org/bugtraq/2019/May/67

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/3997-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2019/dsa-4448

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2019/dsa-4451

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mozilla.org/security/advisories/mfsa2019-07/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.