THREATIST.IORead the docs thunderbird security update
Released 2023-10-04 · Red Hat rating Important · View on Red Hat →
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash.
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash.
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.