Out-of-bounds write in Mozilla Firefox
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.
5 records
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.
If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash.
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash.
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
A compromised content process could have provided malicious data to `FilterNodeD2D1` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.