Vulnerability Instance

Priit Laes reported a crash due to a heap buffer overflow triggered
by a JavaScript regular expression containing
a minimal quantifier. We presume this could be exploited to run
arbitrary code.CanadianGuy, Girts Folkmanis and Catalin Patulea report that a regular
expression that ends with a backslash inside an unterminated
character set (e.g. "[\\") will cause the regular expression engine
to read beyond the end of the buffer, possibly leading to a crash.Thunderbird shares the browser engine with Firefox
and could be vulnerable if JavaScript were to be enabled in mail. This is not
the default setting and we strongly discourage users from enabling
JavaScript in mail.