CVE-2019-17014

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

If an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. This vulnerability affects Firefox < 71.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-170158.8During the initialization of a new content process, a pointer offset can be manipulated leading to memory corruption and a potentially explo CVE-2019-170166.1When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This CVE-2019-170178.8Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough e CVE-2019-170185.3When in Private Browsing Mode on Windows 10, the Windows keyboard may retain word suggestions to improve the accuracy of the keyboard. This CVE-2019-170198.8When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of bei CVE-2019-17026.1Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote att CVE-2019-170206.5If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be CVE-2019-170215.3During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from CVE-2019-170226.1When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Bec CVE-2019-170236.5After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in CVE-2019-170248.8Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corr CVE-2019-170258.8Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume