Package Instance

Security researcher Aki Helin used the Address Sanitizer
tool to find a buffer overflow during video playback on Linux systems. This was
due to a problem in older versions of the Gstreamer plugin during the parsing of
H.264 formatted video. This issue could be used to induce a possibly exploitable
crash.
This issue does not affect the current 1.0 version of Gstreamer
and does not affect Windows or OS X systems.

Mozilla developers and community identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.

Using the Address Sanitizer tool, security researcher Atte
Kettunen found a buffer overflow during the rendering of SVG format
graphics when combined with specific CSS properties on a page. This results in a
potentially exploitable crash.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Security researcher Ucha Gobejishvili used the Address
Sanitizer tool to find a buffer overflow while parsing compressed XML content.
This was due to an error in how buffer space is created and modified when
handling large amounts of XML data. This results in a potentially exploitable
crash.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Security researcher Scott Bell used the Address Sanitizer
tool to discover a use-after-free error during the processing of text when
vertical text is enabled. This leads to a potentially exploitable crash.

Mozilla Developer Jed Davis and Mozilla security engineer
Christoph Diehl reported that Mozilla had inherited a
Inter-process Communication (IPC) vulnerability when IPC was introduced into
Mozilla products through third-party code. This could allow for privilege
escalation through IPC channels due to lack of message validation in the
listener process. 
This issue only affects systems running Windows, leaving Linux
and OS X unaffected.