Security researcher Tsubasa Iinuma reported a mechanism to violate same-origin policy to content using data: and view-soure: URIs to confuse protections and bypass restrictions. This resulted in the ability to read data from cross-site URLs and local files. External Reference: https://www.mozilla.org/security/announce/2015/mfsa2015-149.html Acknowledgements: Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Tsubasa Iinuma as the original reporter.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 Via RHSA-2015:2657 https://rhn.redhat.com/errata/RHSA-2015-2657.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2016:0001 https://rhn.redhat.com/errata/RHSA-2016-0001.html