John Schoenick

The issue is related to an out-of-bounds access flaw in SSL-related code. When allocating memory for a connection, the math used to calculate the extra memory amount necessary for the SSL library was incorrect on 32-bit systems, resulting in too little memory being allocated. This could lead to a crash or other undefined behaviors when accessing the last struct member of the last object within the memory area. The vulnerability is specifically present in 32-bit builds where `sizeof(long long *) < sizeof(long long)`.

The issue allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes. This is related to the lack of protection for internal browser data. An attacker can exploit this to gain access to the full list of disabled plugins using CSS and pseudo-classes.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors.