RHSA-2024:9015

Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3.

By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive.

A clipboard "paste" button could persist across tabs which allowed a spoofing attack.

Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser.

Video frames could have been leaked between origins in some situations.

Truncation of a long URL could have allowed origin spoofing in a permission prompt.

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash.

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements.

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks.

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`.