RHSA-2024:6839

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment.

A mismatch between allocator and deallocator could have led to memory corruption.

Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1.

A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability.

The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes.

Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events.

Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support.

An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash.

Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor.

If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack.

Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva".