Package Instance

Mozilla community member jomo reported a use-after-free crash when
processing WebGL content. This issue was caused by the use of a texture after its recycle
pool has been destroyed during WebGL operations, which frees the memory associated with
the texture. This results in a potentially exploitable crash when the texture is later
called.

Security researcher sushi Anton Larsson reported that when paired
fullscreen and pointerlock requests are done in combination with closing windows, a
pointerlock can be created within a fullscreen window without user permission. This
pointerlock cannot then be cancelled without terminating the browser, resulting in a
persistent denial of service attack. This can also be used for spoofing and clickjacking
attacks against the browser UI.

Mozilla developers and community members reported several memory safety bugs in the
browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed
evidence of memory corruption under certain circumstances, and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.

Security researcher Jordi Chancel reported a method to spoof the
contents of the addressbar. This uses a persistent menu within a
<select> element, which acts as a container for HTML content and can be
placed in an arbitrary location.  When placed over the addressbar, this can mask the true
site URL, allowing for spoofing by a malicious site.

Security researcher firehack reported a buffer overflow when parsing
HTML5 fragments in a foreign context such as under an <svg> node. This
results in a potentially exploitable crash when inserting an HTML fragment into an
existing document.

Security researcher firehack used the Address Sanitizer
tool to discover a use-after-free in contenteditable mode. This occurs when deleting
document object model (DOM) table elements created within the editor and results in a
potentially exploitable crash.