Not rated
CVE-2016-9895 Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline…
Description
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Firefox 50.1 | earliest → < 50.1 | 50.1 |
| Firefox ESR 45.6 | earliest → < 45.6 | 45.6 |
| Thunderbird 45.6 | earliest → < 45.6 | 45.6 |