One of critical issues involved flaws in WebGLES that could be exploited to run malicious code or to bypass a security feature on recent Windows versions, Mozilla explained.
Also, Mozilla fixed a problem with Firefox described as “XSLT generate-id() function heap address leak.” Chris Evans of the Chrome Security Team reported that “the XSLT generate-id() function returned a string that revealed a specific valid address of an object on the memory heap. It is possible that in some cases this address would be valuable information that could be used by an attacker while exploiting a different memory corruption but, in order to make an exploit more reliable or work around mitigation features in the browser or operating system”, Mozilla said.
Finally, Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. “Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code”, Mozilla explained.
In addition, Mozilla updated its Thunderbird email client, fixing vulnerabilities in version 3.1.9. Although Mozilla did not identify the security fixes, the Mac Security blog said the “update most likely contains the same fixes as Firefox 3.6, since it uses the same HTML rendering engine.”