mozilla thunderbird keeps freezing december 2015

This vulnerability affects Thunderbird stream-reinit task may have been executed after the stream was destroyed, causing a use-after-free and a potentially exploitable crash. Previously, this memory was uninitialized, leading to potentially sensitive data disclosure. This vulnerability affects Thunderbird copyTexSubImage method, the specification requires the returned values be zero. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird GMPDecodeData. It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. The known affected products are Element Web And SchildiChat Web. The overflow content is partially controllable by the attacker and limited to ASCII spaces and digits. Furthermore, safe buffer sizes were undocumented. Attackers can construct a crafted sequence of messages to manipulate the state of the receiver's session in such a way that, for some buffer sizes, a buffer overflow happens on a call to olm_session_describe. Therefore, its state is partially controllable by the remote party of the channel. The Olm session object represents a cryptographic channel between two parties.

The olm_session_describe function in Matrix libolm before 3.2.7 is vulnerable to a buffer overflow. Because of this, it us not recommend to deny known problematic regexes. Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. All users accepting user-controlled regexes are recommended to upgrade immediately to the latest version of the regex crate. The fix is include starting from regex 1.5.5.

All versions of the regex crate before or equal to 1.5.4 are affected by this issue. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes. Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This guarantee is documented and it's considered part of the crate's API. Those (tunable) mitigations already provide sane defaults to prevent attacks.

The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Regex is an implementation of regular expressions for the Rust language.

Mozilla thunderbird keeps freezing december 2015