CVE-2023-23598

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Code injection

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Thunderbird 102.7, and Firefox ESR...

CVE-2023-23598: Undefined Security Weakness

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

CVE-2023-23598

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to "DataTransfer.setData". This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbir...

Arbitrary File Read

firefox is vulnerable to Arbitrary File Read. GTK uses 'text/plain' for drag data and treats 'text/plain' MIMEs containing URL's as being dragged. This allows a website to arbitrarily read a file through a call to 'DataTransfer.setData'...

CVE-2023-23598

The Mozilla Foundation Security Advisory describes this flaw as: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData...

CVE-2023-23598

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

PT-2023-1316

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 109 Thunderbird versions prior to 102.7 Firefox ESR versions prior to 102.7 Description The issue arises from the Firefox GTK wrapper code's use of text/plain for drag data, which GTK treats as being dragged if the...