Vulnerabilities

Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3.

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters.

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash.

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule.

Mozilla developers reported memory safety bugs present in Firefox 70 and Firefox ESR 68.2.

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash.

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash.

When using nested workers, a use-after-free could occur during worker destruction.

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable cr…