Mozilla developers and community members reported memory safety bugs present in Firefox 66

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6

Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances

A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 67

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed

A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential memory corruption

In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional…

A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected

A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash

A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs

The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout

The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT)…

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use

Mozilla developers and community members reported memory safety bugs present in Firefox 65

Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling

Mozilla developers and community members reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3

Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module

A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of…

A use-after-free vulnerability can occur while parsing an HTML5 stream in concert with custom HTML elements

Mozilla developers and community members reported memory safety bugs present in Firefox 64 and Firefox ESR 60.4

A crash and out-of-bounds read can occur when the buffer of a texture client is freed while it is still in use during graphic operations

Mozilla developers and community members reported memory safety bugs present in Firefox 64

Memory safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR 52.8

Memory safety bugs present in Firefox 60 and Firefox ESR 60

Memory safety bugs present in Firefox 60

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring

A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored

A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use

Memory safety bugs present in Firefox 61 and Firefox ESR 60.1

WebExtensions bundled with embedded experiments were not correctly checked for proper authorization

Mozilla developers backported selected changes in the Skia library

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths

A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths

Memory safety bugs were reported in Firefox 59

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one

The libtremor library has the same flaw as CVE-2018-5146

Memory safety bugs were reported in Firefox ESR 52.6

A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during editor operations

Memory safety bugs were reported in Firefox 58

A potential integer overflow in the "DoCrypt" function of WebCrypto was identified