Package Instance

Compiler Engineer Dan Gohman of Google discovered a flaw in
the JavaScript engine where memory was being incorrectly allocated for some
functions and the calls for allocations were not always properly checked for
overflow, leading to potential buffer overflows. When combined with other
vulnerabilities, these flaws could be potentially exploitable.
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Mozilla community member Ezra Pool reported a potentially
exploitable crash on extremely large pages. This was caused when a cycle
collected image object was released on the wrong thread during decoding,
creating a race condition.
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to discover a
user-after-free when interacting with HTML document templates. This leads to a
potentially exploitable crash.
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team used the Address Sanitizer tool to discover an access
violation due to uninitialized data during Extensible Stylesheet Language
Transformation (XSLT) processing. This leads to a potentially exploitable
crash. 
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Mozilla developers identified and fixed several memory safety bugs in the
browser engine used in Firefox and other Mozilla-based products. Some of these
bugs showed evidence of memory corruption under certain circumstances, and we
presume that with enough effort at least some of these could be exploited to run
arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts.

Security researcher Nils used the Address Sanitizer tool
while fuzzing to discover missing strong references in browsing engine leading
to use-after-frees. This can lead to a potentially exploitable crash. 
In general these flaws cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts.

Security researcher Byoungyoung Lee of Georgia Tech
Information Security Center (GTISC) used the Address Sanitizer tool to discover
a use-after-free during state change events while updating the offline cache.
This leads to a potentially exploitable crash.
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Security researcher Jordi Chancel discovered a method to put
arbitrary HTML content within <select> elements and place it in arbitrary
locations. This can be used to spoof the displayed addressbar, leading to
clickjacking and other spoofing attacks.
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.

Security researcher Nils used the Address Sanitizer tool
while fuzzing to discover a memory corruption issue with the JavaScript engine
when using workers with direct proxies. This results in a potentially
exploitable crash. 
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled, but is
potentially a risk in browser or browser-like contexts.