description: When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conjunction with another vulnerability this could have been used for an out of bounds memory read. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
problem types: Incorrect AliasSet used in JIT Codegen
affected:
{
vendor: Mozilla
product: Thunderbird
versions:
version: unspecified, lessThan: 91.8, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox
versions:
version: unspecified, lessThan: 99, status: affected, versionType: custom
}
{
vendor: Mozilla
product: Firefox ESR
versions:
version: unspecified, lessThan: 91.8, status: affected, versionType: custom
}
