Johnny Stenback

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 16.0 Firefox ESR versions prior to 10.0.8 Thunderbird versions prior to 16.0 Thunderbird ESR versions prior to 10.0.8 SeaMonkey versions prior to 2.13 **Description** The issue allows remote attackers to bypass intended access restrictions via crafted JavaScript code, due to improper restriction of calls to DOMWindowUtils (aka nsDOMWindowUtils) methods. **Recommendations** For Mozilla Firefox versions prior to 16.0, update to version 16.0 or later. For Firefox ESR versions prior to 10.0.8, update to version 10.0.8 or later. For Thunderbird versions prior to 16.0, update to version 16.0 or later. For Thunderbird ESR versions prior to 10.0.8, update to version 10.0.8 or later. For SeaMonkey versions prior to 2.13, update to version 2.13 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via event handlers. This can be exploited to execute malicious scripts on a user's browser. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** The issue allows remote attackers to execute arbitrary code via unknown vectors that cause JavaScript to execute with the wrong principal, which is related to privilege escalation via incorrect principals. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.10 Mozilla Firefox versions 2.x prior to 2.0.0.2 Thunderbird versions prior to 1.5.0.10 SeaMonkey versions prior to 1.0.8 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption in the JavaScript engine. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For Mozilla Firefox versions 2.x prior to 2.0.0.2, update to version 2.0.0.2 or later. For Thunderbird versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.1 SeaMonkey versions prior to 1.0 **Description** The issue affects the XML parser, allowing remote attackers to cause a denial of service, potentially leading to a crash, and possibly read sensitive data. This is achieved through unknown attack vectors that trigger an out-of-bounds read. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.1, update to version 1.5.0.1 or later to resolve the issue. For SeaMonkey versions prior to 1.0, update to version 1.0 or later to resolve the issue.