Gary Kwong

Large branch table could lead to truncated instruction

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the JavaScript: GC component

Other issue in the JavaScript Engine component

Use-after-free in the JavaScript Engine component

Incorrect boundary conditions in the JavaScript: GC component

Race condition in the JavaScript: GC component

Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects 32-bit ARM devices. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

Return registers were overwritten which could have allowed an attacker to execute arbitrary code. *Note:* This issue only affected Armv7-A systems. Other operating systems are unaffected. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and

An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox < 125.