RHSA-2020:0292

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion.

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash.

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2.

When using nested workers, a use-after-free could occur during worker destruction.

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable cr…

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash.

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer does not escape &lt; and &gt; characters.

When pasting a &lt;style&gt; tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule.