CVE-2019-17016

Al pegar un <style> etiqueta del portapapeles en un editor de texto enriquecido, el saneador CSS reescribe incorrectamente una regla @namespace. Esto podría permitir una inyección en ciertos tipos de sitios web resultando en la filtración de datos. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a la versión 68.4 y Firefox versiones anteriores a la versión 72.

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting attacks, or execute arbitrary code. It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. Various other issues were also addressed.