The SVG filter implementation in Mozilla Firefox prior to 22.0, Firefox ESR 17.x prior to 17.0.7, Thunderbird prior to 17.0.7, and Thunderbird ESR 17.x prior to 17.0.7 allows remote malicious users to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mozilla firefox 19.0 |
||
mozilla firefox 19.0.1 |
||
mozilla firefox 20.0.1 |
||
mozilla firefox |
||
mozilla firefox 19.0.2 |
||
mozilla firefox 20.0 |
||
mozilla firefox esr 17.0.2 |
||
mozilla firefox esr 17.0.1 |
||
mozilla firefox esr 17.0 |
||
mozilla firefox esr 17.0.3 |
||
mozilla firefox esr 17.0.6 |
||
mozilla firefox esr 17.0.4 |
||
mozilla firefox esr 17.0.5 |
||
mozilla thunderbird 17.0.2 |
||
mozilla thunderbird 17.0 |
||
mozilla thunderbird 17.0.1 |
||
mozilla thunderbird 17.0.3 |
||
mozilla thunderbird |
||
mozilla thunderbird 17.0.4 |
||
mozilla thunderbird 17.0.5 |
||
mozilla thunderbird esr 17.0 |
||
mozilla thunderbird esr 17.0.1 |
||
mozilla thunderbird esr 17.0.2 |
||
mozilla thunderbird esr 17.0.3 |
||
mozilla thunderbird esr 17.0.6 |
||
mozilla thunderbird esr 17.0.4 |
||
mozilla thunderbird esr 17.0.5 |