CVE-2019-17016

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.4 Firefox versions prior to 72

Description The issue arises when pasting a <style> tag from the clipboard into a rich text editor, causing the CSS sanitizer to incorrectly rewrite a @namespace rule. This could lead to injection into certain types of websites, resulting in data exfiltration. The vulnerability may allow a remote attacker to impact data integrity.

Recommendations For Firefox ESR versions prior to 68.4, update to version 68.4 or later. For Firefox versions prior to 72, update to version 72 or later.