CVE-2019-17000 log

Source
Severity Medium
Remote Yes
Type Access restriction bypass
Description
A CSP bypass has been found in Firefox 69, where an object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypass in a cross-origin frame if the document's policy explicitly allowed data: URIs.
Group Package Affected Fixed Severity Status Ticket
AVG-1055 firefox 69.0.3-1 70.0-1 Critical Fixed
Date Advisory Group Package Severity Description
26 Oct 2019 ASA-201910-16 AVG-1055 firefox Critical multiple issues
References
https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-17000
https://bugzilla.mozilla.org/show_bug.cgi?id=1441468