Frédéric Hoguin

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 47.0 Mozilla Firefox ESR versions prior to 45.2 **Description** The issue is related to the maintenance service in Mozilla Firefox, which does not properly prevent modification of extracted files during the execution of the updater. This might allow local users to gain privileges via a Trojan horse file. The vulnerability is associated with insufficient access control, which can be exploited by a local attacker to elevate their privileges using a malicious file. **Recommendations** For Mozilla Firefox versions prior to 47.0, update to version 47.0 or later. For Mozilla Firefox ESR versions prior to 45.2, update to version 45.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 20.0 Firefox ESR versions 17.x prior to 17.0.5 Thunderbird versions prior to 17.0.5 Thunderbird ESR versions 17.x prior to 17.0.5 **Description** A buffer overflow issue in the Mozilla Maintenance Service allows local users to gain privileges via crafted arguments. This issue is specific to Windows. **Recommendations** For Mozilla Firefox versions prior to 20.0, update to version 20.0 or later. For Firefox ESR versions 17.x prior to 17.0.5, update to version 17.0.5 or later. For Thunderbird versions prior to 17.0.5, update to version 17.0.5 or later. For Thunderbird ESR versions 17.x prior to 17.0.5, update to version 17.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 15.0 Firefox ESR versions prior to 10.0.7 Thunderbird versions prior to 15.0 Thunderbird ESR versions prior to 10.0.7 SeaMonkey versions prior to 2.12 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption. This is achieved by using a negative height value in a BMP image within a .ICO file. The problem is related to improper handling of the transparency bitmask by the nsICODecoder component and improper processing of the alpha channel by the nsBMPDecoder component. **Recommendations** For Mozilla Firefox versions prior to 15.0, update to version 15.0 or later. For Firefox ESR versions prior to 10.0.7, update to version 10.0.7 or later. For Thunderbird versions prior to 15.0, update to version 15.0 or later. For Thunderbird ESR versions prior to 10.0.7, update to version 10.0.7 or later. For SeaMonkey versions prior to 2.12, update to version 2.12 or later.