Mozilla Firefox and Thunderbird Uninitialized Memory Disclosure Vulnerability via String Manipulation

A vulnerability exists in Mozilla Firefox versions prior to 136 and Thunderbird versions prior to 136, where the String.toUpperCase() method could unintentionally incorporate uninitialized memory into the result. This issue arises when the method causes a string to lengthen, potentially leading to the disclosure of sensitive information.

Impact

Exploitation of this vulnerability could result in the unintentional disclosure of uninitialized memory, which may contain sensitive information.

Remediation

Users can upgrade to Firefox 136 or Thunderbird 136 to address this vulnerability.