Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
| Software | From | Fixed in |
|---|---|---|
| mozilla / thunderbird | - | 60.6.1 |
| mozilla / firefox | - | 66.0.1 |
| mozilla / firefox | - | 60.6.1 |