Vulnerabilities

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup.

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions.

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user.

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it.

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts.

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error.

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.

Memory safety bugs were reported in Thunderbird 45.7.