Bob Owen

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 63 Firefox ESR versions prior to 60.3 Thunderbird versions prior to 60.3 **Description** The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. It is also described as a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 63, update to version 63 or later. For Firefox ESR versions prior to 60.3, update to version 60.3 or later. For Thunderbird versions prior to 60.3, update to version 60.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 52 Thunderbird versions prior to 52 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 52, update to version 52 or later. For Thunderbird versions prior to 52, update to version 52 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50 **Description** The issue is related to the sandbox for 64-bit NPAPI plugins not being enabled by default when a new Firefox profile is created on 64-bit Windows installations. This can allow a remote attacker to bypass security restrictions. The issue only affects 64-bit Windows installations, while 32-bit Windows and other operating systems are unaffected. **Recommendations** For Firefox versions prior to 50, update to version 50 or later to resolve the issue. As a temporary workaround, consider enabling the sandbox for 64-bit NPAPI plugins manually until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 22.0 **Description** The issue arises from improper implementation of certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element. This allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element. **Recommendations** For versions prior to 22.0, update to version 22.0 or later to resolve the issue.