Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
[
{
"product": "Firefox ESR",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "68.10",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "78",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "68.10.0",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
]
lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html
lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html
bugzilla.mozilla.org/show_bug.cgi?id=1641303
security.gentoo.org/glsa/202007-09
security.gentoo.org/glsa/202007-10
usn.ubuntu.com/4421-1/
www.mozilla.org/security/advisories/mfsa2020-24/
www.mozilla.org/security/advisories/mfsa2020-25/
www.mozilla.org/security/advisories/mfsa2020-26/