mozilla::dom::ImageDocument::UpdateSizeFromLayout DoS

The vulnerability of the mozilla::dom::ImageDocument::UpdateSizeFromLayout function in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the use of memory after object release, resulting from manipulations of DOM objects when the “resize” event is called for the “image”...