Memory disclosure via malicious IPC messages

Cross-process information disclosure in Mozilla Firefox, Firefox ESR, and Thunderbird allows attackers to read privileged-process memory. The privileged browser process responds to malicious IPC messages from a compromised web process by returning blocks of its own memory. Exploitation requires prior compromise of a sandboxed web process; the disclosed blocks can expose data held by the more privileged process.