Memory safety bugs present in Firefox 134 and Thunderbird 134

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6

An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash

Memory safety bugs fixed in Firefox 134 and Thunderbird 134

A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path

A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition

The executable file warning was not presented when downloading .library-ms files

Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2

Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2

A compromised content process could have allowed for the arbitrary loading of cross-origin pages

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies

A mismatch between allocator and deallocator could have led to memory corruption

The executable file warning was not presented when downloading .xrm-ms files

Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3

Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially…

A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a…

Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download

An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable crash

Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages

A use-after-free in WebGL extensions could have led to a potentially exploitable crash

If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape

Session history navigations may have led to a use-after-free and potentially exploitable crash

Mozilla developers Andrew McCreight, Nicolas B

A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash

A malicious website could have learned the size of a cross-origin resource that supported Range requests

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 99 and Firefox ESR 91.8

Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in…

An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7

Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6

Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6

A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially exploitable crash

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7

A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email messages, resulting in a potentially…

A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email messages, resulting in a potentially…

A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages, resulting in a potentially exploitable…

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash