CVE-2024-5693

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-829

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 127
Mozilla	Firefox ESR	>= unspecified, < 115.12
Mozilla	Thunderbird	>= unspecified, < 115.12
mozilla	firefox	< 127
mozilla	firefox_esr	< 115.12
mozilla	thunderbird	< 115.12

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1891319Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1891319Issue Tracking
https://lists.debian.org/debian-lts-announce/2024/06/msg00000.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/06/msg00010.htmlMailing List, Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2024-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-26/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2024-28/Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-569385.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.CVE-2024-569395.4LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.CVE-2024-56947.5An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vu CVE-2024-569407.5An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file upl CVE-2024-569465.3Denial of service in DNS-over-QUIC in Technitium DNS Server <= v13.2.2 allows remote attackers to permanently stop the server from accepting CVE-2024-569476.5An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a c CVE-2024-569486.5An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted l CVE-2024-569496.5An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user inform CVE-2024-56959.8If an out-of-memory condition occurs at a specific point using allocations in the probabilistic heap checker, an assertion could have been t CVE-2024-569506.5An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted CVE-2024-569516.5An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying CVE-2024-569526.5An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information