Due to unexpected data type conversions, a use-after-free could have occurred when interacting with the font cache. We presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 88.
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
Link | Tags |
---|---|
https://www.mozilla.org/security/advisories/mfsa2021-16/ | release notes vendor advisory |
https://bugzilla.mozilla.org/show_bug.cgi?id=1701942 | issue tracking permissions required vendor advisory |