A state confusion issue has been found in Firefox before 74, in BodyStream::OnInputStreamReady. By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash.
A state confusion issue has been found in Firefox before 74, in BodyStream::OnInputStreamReady. By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end of an array resized during script execution. This could have led to memory corruption and a potentially exploitable crash.
https://www.mozilla.org/en-US/security/advisories/mfsa2020-08/#CVE-2020-6806 https://bugzilla.mozilla.org/show_bug.cgi?id=1612308
Vulmon