Vulnerabilities

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6.

If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks.

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups.

Images from a different domain can be read using a canvas object in some circumstances.

A race condition is present in the crash generation server used to generate data for the crash reporter.

A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash.

A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use.

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed.

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash.

The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux.

A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file.

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be…