Package Instance

An anonymous security researcher working with Trend Micro's Zero Day Initiative
reported a buffer overflow in the ClearKey Content Decryption Module (CDM) used by the
Encrypted Media Extensions (EME) API. This vulnerability can be triggered using a
malformed video file due to incorrect error handling. This could allow arbitrary code
execution if combined with a second vulnerability that allows an escape from the Gecko
Media Plugin (GMP) sandbox. Without such a vulnerability, the buffer overflow is contained
within the GMP sandbox and cannot be exploited.

Security researcher Abdulrahman Alqabandi reported that when a local
HTML file resides in the same directory as a malicious local shortcut file, the shortcut
can be called by the local page to allow the page to read the contents of local files or
directories or to load an arbitrary website in violation of same-origin policy, allowing
for data theft. In order for this vulnerability to be triggered, both the malicious HTML
file as well as the shortcut must be saved to the same local directory and then loaded
from there by a user.

Mozilla developers and community members reported several memory safety bugs in the
browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed
evidence of memory corruption under certain circumstances, and we presume that with enough
effort at least some of these could be exploited to run arbitrary code.

Security researcher Nikita Arykov reported that JavaScript event
handler attributes on a <marquee> tag will execute inside a sandboxed
iframe that does not have the allow-scripts flag set. This could result in a cross-site
scripting (XSS) vulnerability in a site that depends on the iframe sandbox for
sanitization and does no other content filtering.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team reported a use-after-free vulnerability when the alt key
is used in conjunction with toplevel menu items in Firefox. This results in a potentially
exploitable crash when triggered. This vulnerability is mitigated by not being triggerable
by web content, only direct user interaction with the keyboard.

Using the Address Sanitizer tool, security researcher Atte Kettunen
found a buffer overflow during the rendering of SVG format graphics with directional
content. This is caused by a flaw in directional-isolate processing and results in a
potentially exploitable crash.

Security researcher Looben Yang reported a use-after-free
vulnerability in WebRTC. This occurs during WebRTC session shutdown when DTLS objects in
memory are freed while still actively in use. This results in a potentially exploitable
crash.

Georg Koppen of the Tor Project used the Address Sanitizer tool to
discover a stack buffer underflow when calculating clipping regions in 2D graphics. This
results in a potentially exploitable crash.

Security researcher Looben Yang discovered a use-after-free
vulnerability when working with nested sync event loops in Service Workers. He discovered
a mechanism where scripts can close their own worker, which will then trigger a
synchronization XMLHttpRequest on this now closed and released worker. This results in a
potentially exploitable crash when triggered.

Security researcher Nils used the Address Sanitizer tool to discover a
use-after-free vulnerability when applying effects to SVG elements. This results in a
potentially exploitable crash.

Security researcher Toni Huttunen reported that once the favicon is
requested from a site, the remote server can keep the favicon network connection open even
when the page is later closed. This allows a malicious site to continue to use this
channel to send requests to the browser, leading to potential information disclosure, such as tracking the user across multiple IP addresses as the user changes networks.

Using the Address Sanitizer tool, security researcher Nils reported a
type confusion flaw in display transformation during rendering due to incorrect bounds
checking. This leads to a potentially exploitable crash and can be triggered by web
content.

Security researcher Bert Massop reported a crash in the Cairo graphics
layer on Linux systems using the LibAV library included in version 0.10 of the FFmpeg
library. This was due to an error when allocating the LibAV header when decoding some
videos.
This only affects systems running the Linux operating system that also
have FFMpeg version 0.10 installed and does not affect OS X or Windows systems.