Package Instance

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to discover a series of
use-after-free problems rated critical as security issues in shipped software.
Some of these issues are potentially exploitable, allowing for remote code
execution. We would also like to thank Abhishek for reporting additional
use-after-free and buffer overflow flaws in code introduced during Firefox
development. These were fixed before general release.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Security researcher Johnathan Kuskos reported that Firefox
is sending data in the body of  XMLHttpRequest (XHR) HEAD requests, which goes
against the XHR specification. This can potentially be used for Cross-Site
Request Forgery (CSRF) attacks against sites which do not distinguish
between HEAD and POST requests.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Mozilla developer Boris Zbarsky found that when
PreserveWrapper was used in cases where a wrapper is not set, the
preserved-wrapper flag on the wrapper cache is cleared. This could
potentially lead to an exploitable crash.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Mozilla security researcher moz_bug_r_a4 reported that
XrayWrappers can be bypassed to call content-defined toString and valueOf methods through DefaultValue. This can lead to unexpected behavior when privileged code acts on the incorrect values.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Security researcher Paul Stone of Context Information Security discovered
that timing differences in the processing of SVG format images with filters
could allow for pixel values to be read. This could potentially allow for text
values to be read across domains, leading to information disclosure.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Security researcher Nils reported that specially crafted web
content using the onreadystatechange event and reloading of pages
could sometimes cause a crash when unmapped memory is executed. This crash is
potentially exploitable.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Security researcher Mariusz Mlynski reported that it is
possible to compile a user-defined function in the XBL scope of a specific
element and then trigger an event within this scope to run code. In some
circumstances, when this code is run, it can access content protected by System
Only Wrappers (SOW) and chrome-privileged pages. This could potentially lead to
arbitrary code execution. Additionally, Chrome Object Wrappers (COW) can be
bypassed by web content to access privileged methods, leading to a cross-site
scripting (XSS) attack from privileged pages.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Mozilla developers identified and fixed several memory safety bugs in the
browser engine used in Firefox and other Mozilla-based products. Some of these
bugs showed evidence of memory corruption under certain circumstances, and we
presume that with enough effort at least some of these could be exploited to run
arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are
potentially a risk in browser or browser-like contexts.