Remote Yes

Type Same-origin policy bypass

Description

SVG loaded through <img> tags in Firefox before 57.0 can use <meta> tags within the SVG data to set cookies for that page.

AVG-494 firefox 56.0.2-1 57.0-1 Critical Fixed

15 Nov 2017 ASA-201711-23 AVG-494 firefox Critical multiple issues

https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7837
https://bugzilla.mozilla.org/show_bug.cgi?id=1325923