Vulnerabilities

Memory safety bugs present in Firefox 111 and Firefox ESR 102.9.

A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result.

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands.

When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character.

An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled memory, resulting in an assertion, memory corruption, or a potentially exploitable crash.

Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced.

A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls.

Unexpected data returned from the Safe Browsing API could have led to memory corruption and a potentially exploitable crash.

OCSP revocation status of recipient certificates was not checked when sending S/Mime encrypted email, and revoked certificates would be accepted.