Vulnerabilities

Several fonts on OS X display some Tibetan and Arabic characters as whitespace.

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content.

The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always specified.

A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory.

A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM.

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files.

Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3.

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain.

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer.

When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored.

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element.

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is freed while still in use.

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished.

A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use, resulting in a potentially exploitable crash.

A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely long object identifier (OID).

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin of the modal alert from the iframe content…

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to information disclosure.

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements.

A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM.

Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2.

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data.