CVE-2017-7844

A combination of an external SVG image referenced on a page and the coloring of anchor links stored within this image can be used to determine which pages a user has in their history. This can allow a malicious website to query user history. Note: This issue only affects Firefox 57. Earlier...

CVE-2017-5407

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information...

CVE-2016-5296

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird 45.5, Firefox ESR 45.5, and Firefox 50...

CVE-2017-7837

SVG loaded through "" tags can use "" tags within the SVG data to set cookies for that page. This vulnerability affects Firefox 57...

CVE-2018-5155

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.8, Thunderbird ESR 52.8, Firefox 60, and Firefox ESR 52.8...

Security fix for the ALT Linux 10 package firefox-esr version 60.0.2-alt1

June 11, 2018 Andrey Cherepanov 60.0.2-alt1 - New ESR version 60.0.2. - Fixed: + CVE-2018-6126 Heap buffer overflow rasterizing paths in SVG with Skia...

FreeBSD : firefox -- Heap buffer overflow rasterizing paths in SVG with Skia (e3e68fe8-d9cb-4ba8-b09c-9e3a28588eb7)

The Mozilla Foundation reports : A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash. C Tenable Network Security, Inc. The descriptive text and package check...

CVE-2016-9079

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox 50.0.2, Firefox ESR 45.5.1, and Thunderbird 45.5.1. Recent assessments...

openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2018-575)

This update for MozillaFirefox, mozilla-nss fixes the following issues : Security issue fixed in Mozilla Firefox 60.0.2 ESR : - CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia MFSA 2018-14, boo1096449 The following bugs were fixed : - In KDE Open with option in download...

[SECURITY] Fedora 28 Update: batik-1.10-1.fc28

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

[SECURITY] Fedora 27 Update: batik-1.10-1.fc27

Batik is a Javatm technology based toolkit for applications that want to use images in the Scalable Vector Graphics SVG format for various purposes, such as viewing, generation or manipulation...

uwvakantiehuisonline.nl XSS vulnerability

Open Bug Bounty ID: OBB-629581 Description| Value ---|--- Affected Website:| uwvakantiehuisonline.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

KLA11259 DoS vulnerability in Mozilla Firefox and Firefox ESR

A heap buffer overflow vulnerability was found in the Skia library. By exploiting this vulnerability malicious users can cause denial of service via specially crafted SVG file with anti-aliasing turned off. Original advisories Mozilla Foundation Security Advisory 2018-14 Exploitation Public...

[ASA-201806-5] firefox: arbitrary code execution

Arch Linux Security Advisory ASA-201806-5 ========================================= Severity: High Date : 2018-06-08 CVE-ID : CVE-2018-6126 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-715 Summary ======= The package firefox before versi...

CVE-2018-1000041

GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable v...

Skia: Heap buffer overflow rasterizing paths in SVG

A precision error in Skia in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page...

firefox -- Heap buffer overflow rasterizing paths in SVG with Skia

The Mozilla Foundation reports: A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash...

Security vulnerabilities fixed in Firefox 60.0.2, ESR 60.0.2, and ESR 52.8.1 — Mozilla

A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with anti-aliasing turned off. This results in a potentially exploitable crash...

Security fix for the ALT Linux 10 package firefox-esr version 60.0.1-alt1

June 5, 2018 Andrey Cherepanov 60.0.1-alt1 - New ESR version 60.0.1. - Fixed: + CVE-2018-5154: Use-after-free with SVG animations and clip paths + CVE-2018-5155: Use-after-free with SVG animations and text paths + CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files +...

Debian DSA-4215-1 : batik - security update

Man Yue Mo, Lars Krapf and Pierre Ernst discovered that Batik, a toolkit for processing SVG images, did not properly validate its input. This would allow an attacker to cause a denial-of-service, mount cross-site scripting attacks, or access restricted files on the server. C Tenable Network...