Package Instance

Mozilla developers and community identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.

The CESG, the Information Security Arm of GCHQ, reported a dangling
pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI)
that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted
NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable
crash when triggered.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Mozilla developer Boris Zbarsky reported an inconsistency
with the different JavaScript engines in how JavaScript native getters on
window objects are handled by these engines. This inconsistency can
lead to different behaviors in JavaScript code, allowing for a potential
security issue with window handling by bypassing of some security checks. 
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled in mail, but is
potentially a risk in browser or browser-like contexts.

Using Address Sanitizer, security researcher Sascha Just reported a
buffer overflow in the libstagefright library due to issues with the handling of CENC
offsets and the sizes table. This results in a potentially exploitable crash triggerable
through web content.

Security researchers Tyson Smith and Jesse
Schwartzentruber of the BlackBerry Security Automated Analysis Team
used the Address Sanitizer tool while fuzzing to discover a use-after-free
during host resolution in some circumstances. This leads to a potentially
exploitable crash.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team reported an out of bounds write in the 
Netscape 
Portable Runtime (NSPR) leading to a potentially exploitable crash or code
execution. This issue is fixed in NSPR version 4.10.6.
This NSPR flaw was not exposed to web content in any shipped version of Firefox.

Mozilla developers and community identified identified and fixed several
memory safety bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.

Security researcher Ronald Crane reported eight
vulnerabilities affecting released code that were found through code inspection. These
included several potential memory safety issues resulting from the use of
snprintf, one use of unowned memory, one use of a string without overflow
checks, and five memory safety bugs. These do not all have clear mechanisms to be
exploited through web content but are vulnerable if a mechanism can be found to trigger
them.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Mozilla developers fixed several memory safety bugs in the browser engine used in
Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with enough effort at least
some of these could be exploited to run arbitrary code.

Security researcher Herre reported a use-after-free
vulnerability when a Content Policy modifies the Document Object Model to
remove a DOM object, which is then used afterwards due to an error in microtask
implementation. This leads to an exploitable crash.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Mozilla engineers Tyson Smith and David Keeler
reported a use-after-poison and buffer overflow in the ASN.1 decoder in Network Security
Services (NSS). These issues were in octet string parsing and were found through fuzzing
and code inspection. If these issues were triggered, they would lead to a potentially
exploitable crash. These issues were fixed in NSS version 3.19.2.1 and 3.19.4, shipped in
Firefox and Firefox ESR, respectively, as well as NSS 3.20.1.Google security engineer Ryan Sleevi reported an integer overflow in
the Netscape Portable Runtime (NSPR) due to a lack of checks during memory allocation.
This leads to a potentially exploitable crash. This issue is fixed in NSPR 4.10.10. The NSPR library is a required component of NSS.

Security researcher Aki Helin used the Address Sanitizer
tool to find a buffer overflow during video playback on Linux systems. This was
due to a problem in older versions of the Gstreamer plugin during the parsing of
H.264 formatted video. This issue could be used to induce a possibly exploitable
crash.
This issue does not affect the current 1.0 version of Gstreamer
and does not affect Windows or OS X systems.