CVE-2019-17016 log

Source
Severity High
Remote Yes
Type Insufficient validation
Description
A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration.
Group Package Affected Fixed Severity Status Ticket
AVG-1086 thunderbird 68.3.1-1 68.4.1-1 Critical Fixed
AVG-1084 firefox 71.0-1 72.0-1 Critical Fixed
Date Advisory Group Package Severity Description
14 Jan 2020 ASA-202001-4 AVG-1086 thunderbird Critical multiple issues
08 Jan 2020 ASA-202001-1 AVG-1084 firefox Critical multiple issues
References
https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17016
https://bugzilla.mozilla.org/show_bug.cgi?id=1599181