Vulnerabilities

Memory safety bugs present in Firefox 124.

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9.

There was no limit to the number of HTTP/2 CONTINUATION frames that would be processed.

The executable file warning was not presented when downloading .xrm-ms files.

The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment.

If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free.

An out-of-memory condition during object initialization could result in an empty shape list.

On 32-bit versions there were integer-overflows that led to an out-of-bounds-read that potentially could be triggered by a malformed OpenType font.

It was possible to mutate a JavaScript object so that the JIT could crash while tracing it.

The JIT created incorrect code for arguments in certain cases.

A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array.

In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads.

In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads.

A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started.

GetBoundName could return the wrong version of an object when JIT optimizations were applied.