Paul Theriault

The issue is related to the construction of a permission prompt for WebRTC, where an untrusted URI from the content process could bypass the prompt if it was the URI of an origin previously granted permission. This could allow a remote attacker to bypass existing security restrictions.

The issue is related to a lack of validation in the parent process of Firefox, which could allow an attacker to grant attacker-controlled permissions instead of the 'Click to Play' permission when a user accepts a permission request. This could potentially impact the integrity of data.

The issue is related to insufficient bounds checking of data during inter-process communication, which might allow a compromised content process to read memory from the parent process under certain conditions. This could potentially enable a remote attacker to access confidential data.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 64 Description: The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. Recommendations: For versions prior to 64, update to version 64 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 58 Description: The issue is related to the Activity Stream page in Mozilla Firefox, where a lack of protection for internal data can be exploited. This could allow a remote attacker to gain unauthorized access to protected information using a 'file:' URL. The vulnerability involves the creation of screenshot images from meta tags of websites, which can attempt to load local files through 'file:' URLs, potentially exposing local data if combined with another attack that bypasses sandbox protections. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider restricting access to local files when using the Activity Stream page until a patch is applied. Avoid using 'file:' URLs in the Activity Stream page to minimize the risk of exploitation.

The issue allows for a sandbox escape and escalation of privilege when combined with another vulnerability that results in remote code execution inside the sandboxed process. This is due to the internal feed reader APIs crossing the sandbox barrier.

The issue is related to the lack of protection for system messages in Firefox OS, allowing attackers to obtain potentially sensitive information via a crafted app. This could enable a remote attacker to access protected information contained in system messages.