RHSA-2019:3196

In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted…

Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1.

A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling.

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack.

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed.

When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it.

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities.

If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/getters/setters on the now-cross-origin window.

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content.