Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66. Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9797 Reference (s):
- BUGTRAQ:20190522 [slackware-security] mozilla-firefox (SSA:2019-141-01)
- URL: https://seclists.org/bugtraq/2019/May/56
- BUGTRAQ:20190523 [SECURITY] [DSA 4448-1] firefox-esr security update
- URL: https://seclists.org/bugtraq/2019/May/59
- BUGTRAQ:20190527 [SECURITY] [DSA 4451-1] thunderbird security update