Firefox sometimes ran the onload handler for SVG elements that...

Vulnerability Description

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

References

• https://www.mozilla.org/security/advisories/mfsa2020-43/
• https://www.mozilla.org/security/advisories/mfsa2020-44/
• https://www.mozilla.org/security/advisories/mfsa2020-42/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1646140
• https://www.debian.org/security/2020/dsa-4770
• https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html
• https://security.gentoo.org/glsa/202010-02
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html