QID 356892

a potential use-after-free vulnerability existed in svg images if the refresh driver was destroyed at an inopportune time.
this could have lead to memory corruption or a potentially exploitable crash. *note*: this advisory was added on december 13th, 2022 after discovering it was inadvertently left out of the original advisory.
The fix was included in the original release of firefox 106.
This vulnerability affects firefox < 106. (
( CVE-2022-46884) when firefox is configured to block storage of all cookies, it was still possible to store data in localstorage by using an iframe with a source of about:blank.
This could have led to malicious websites storing tracking data without permission.
This vulnerability affects firefox < 115. (
( CVE-2023-3482) insufficient validation in the drag and drop api in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files.
this could have been leveraged to execute arbitrary code.
( CVE-2023-37203) a website could have obscured the fullscreen notification by using an option element by introducing lag via an expensive computational function.
This could have led to user confusion and possible spoofing attacks.
( CVE-2023-37204) the use of rtl arabic characters in the address bar may have allowed for url spoofing.
( CVE-2023-37205) uploading files which contain symlinks may have allowed an attacker to trick a user into submitting sensitive data to a malicious website.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.