Package Instance

Security researcher Arthur Gerkis used the Address Sanitizer
tool to find two issues involving Scalable Vector Graphics (SVG) files. The
first issue is a buffer overflow in Gecko's SVG filter code when the sum of two
values is too large to be stored as a signed 32-bit integer, causing the
function to write past the end of an array. The second issue is a use-after-free
when an element with a "requiredFeatures" attribute is moved between documents.
In that situation, the internal representation of the "requiredFeatures" value
could be freed prematurely. Both issues are potentially exploitable.

Security researcher miaubiz used the Address Sanitizer tool
to discover two WebGL issues. The first issue is a use-after-free when WebGL
shaders are called after being destroyed. The second issue exposes a problem
with Mesa drivers on Linux, leading to a potentially exploitable crash.

Security researcher Arthur Gerkis used the Address Sanitizer
tool to find two issues involving Scalable Vector Graphics (SVG) files. The
first issue is a buffer overflow in Gecko's SVG filter code when the sum of two
values is too large to be stored as a signed 32-bit integer, causing the
function to write past the end of an array. The second issue is a use-after-free
when an element with a "requiredFeatures" attribute is moved between documents.
In that situation, the internal representation of the "requiredFeatures" value
could be freed prematurely. Both issues are potentially exploitable.

Mozilla developers identified and fixed several memory safety bugs in the
browser engine used in Firefox and other Mozilla-based products. Some of these
bugs showed evidence of memory corruption under certain circumstances, and we
presume that with enough effort at least some of these could be exploited to run
arbitrary code.In general these flaws cannot be exploited through email in the Thunderbird
and SeaMonkey products because scripting is disabled, but are potentially a risk
in browser or browser-like contexts in those products.

Security researcher Frédéric Hoguin reported two related
issues with the decoding of bitmap (.BMP) format images embedded in icon (.ICO)
format files. When processing a negative "height" header value for the bitmap
image, a memory corruption can be induced, allowing an attacker to write random
memory and cause a crash. This crash may be potentially exploitable.

Mozilla security researcher moz_bug_r_a4 reported that
certain security checks in the location object can be bypassed if chrome code is
called content in a specific manner. This allowed for the loading of restricted
content. This can be combined with other issues to become potentially
exploitable.

Security research Nicolas Grégoire used the Address
Sanitizer tool to discover an out-of-bounds read in the format-number feature of
XSLT, which can cause inaccurate formatting of numbers and information leakage.
This is not directly exploitable.

Security researcher Colby Russell discovered that eval in
the web console can execute injected code with chrome privileges, leading to the
running of malicious code in a privileged context. This allows for arbitrary
code execution through a malicious web page if the web console is invoked by the
user.

Security researcher miaubiz used the Address Sanitizer tool
to discover two WebGL issues. The first issue is a use-after-free when WebGL
shaders are called after being destroyed. The second issue exposes a problem
with Mesa drivers on Linux, leading to a potentially exploitable crash.