Olli Pettay

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird ESR versions prior to 140.8 **Description** The software contains memory safety bugs that exhibit evidence of memory corruption. It is presumed that, with sufficient effort, these bugs could be exploited to execute arbitrary code. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird ESR to version 140.8 or later.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 108 Versões do Firefox ESR anteriores à 102.6 Versões do Thunderbird anteriores à 102.6 **Descrição** O problema está relacionado a falhas de segurança de memória e estouro de buffer, o que poderia permitir que um invasor remoto acessasse dados confidenciais, comprometesse a integridade dos dados e causasse uma negação de serviço. Algumas dessas falhas apresentaram indícios de corrupção de memória e presume-se que, com esforço suficiente, algumas delas poderiam ter sido exploradas para executar código arbitrário. **Recomendações** Para versões do Firefox anteriores à 108, atualize para a versão 108 ou posterior. Para versões do Firefox ESR anteriores à 102.6, atualize para a versão 102.6 ou posterior. Para versões do Thunderbird anteriores à 102.6, atualize para a versão 102.6 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 91 Versões do Firefox ESR anteriores à 78.13 Versões do Thunderbird anteriores à 78.13 **Descrição** O problema está relacionado a falhas de segurança de memória, incluindo evidências de corrupção de memória, que poderiam ser potencialmente exploradas para executar código arbitrário com esforço suficiente. Também está associado a um erro de limite ao processar conteúdo HTML, permitindo que um invasor remoto execute código arbitrário e cause danos à memória. **Recomendações** Para versões do Firefox anteriores à 91, atualize para a versão 91 ou posterior. Para versões do Firefox ESR anteriores à 78.13, atualize para a versão 78.13 ou posterior. Para versões do Thunderbird anteriores à 78.13, atualize para a versão 78.13 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 90 Versões do Firefox ESR anteriores à 78.12 Versões do Thunderbird anteriores à 78.12 **Descrição** O problema está relacionado a falhas de segurança de memória presentes no código compartilhado entre o Firefox e o Thunderbird, o que pode levar à corrupção de memória. Com esforço suficiente, essas falhas poderiam ser exploradas para executar código arbitrário, permitindo que um invasor remoto acesse dados confidenciais, comprometa sua integridade e cause uma negação de serviço. **Recomendações** Para versões do Firefox anteriores à 90, atualize para a versão 90 ou posterior. Para versões do Firefox ESR anteriores à 78.12, atualize para a versão 78.12 ou posterior. Para versões do Thunderbird anteriores à 78.12, atualize para a versão 78.12 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 Firefox ESR versions prior to 60.7 Thunderbird versions prior to 60.7 **Description** The issue is related to memory safety bugs, which can lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer data boundary operation issue, which can allow a remote attacker to cause a denial of service and disrupt data integrity. **Recommendations** For Firefox versions prior to 67, update to version 67 or later. For Firefox ESR versions prior to 60.7, update to version 60.7 or later. For Thunderbird versions prior to 60.7, update to version 60.7 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 59 Firefox ESR versions prior to 52.7 Thunderbird versions prior to 52.7 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to gain unauthorized access to information and compromise its integrity and availability. Memory safety bugs were reported, showing evidence of memory corruption, and it is presumed that these could be exploited to run arbitrary code with enough effort. **Recommendations** For Firefox versions prior to 59, update to version 59 or later to resolve the issue. For Firefox ESR versions prior to 52.7, update to version 52.7 or later to resolve the issue. For Thunderbird versions prior to 52.7, update to version 52.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 51 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For versions prior to 51, update to version 51 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50.1 Firefox ESR versions prior to 45.6 Thunderbird versions prior to 45.6 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 50.1, update to version 50.1 or later. For Firefox ESR versions prior to 45.6, update to version 45.6 or later. For Thunderbird versions prior to 45.6, update to version 45.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 49 and earlier Firefox ESR versions 45.4 and earlier Thunderbird versions prior to 45.5 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions 49 and earlier, update to version 50 or later. For Firefox ESR versions 45.4 and earlier, update to version 45.5 or later. For Thunderbird versions prior to 45.5, update to version 45.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 41.0 Mozilla Firefox ESR versions 38.x prior to 38.3 **Description** The issue is caused by buffer overflow, allowing a remote attacker to potentially execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash. **Recommendations** For Mozilla Firefox versions prior to 41.0, update to version 41.0 or later. For Mozilla Firefox ESR versions 38.x prior to 38.3, update to version 38.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 37.0 Firefox ESR versions 31.x prior to 31.6 Thunderbird versions prior to 31.6 **Description** The issue allows a remote attacker to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation. This can be achieved by exploiting the vulnerability in the affected software, allowing the attacker to perform actions with elevated privileges. **Recommendations** For Mozilla Firefox versions prior to 37.0, update to version 37.0 or later to resolve the issue. For Firefox ESR versions 31.x prior to 31.6, update to version 31.6 or later to resolve the issue. For Thunderbird versions prior to 31.6, update to version 31.6 or later to resolve the issue. As a temporary workaround, consider restricting access to anchor navigation in the affected software until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.13 Mozilla Firefox versions 3.6.x through 3.6.10 Thunderbird versions 3.0.x through 3.0.8 Thunderbird versions 3.1.x through 3.1.4 SeaMonkey versions 2.0.x through 2.0.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.13, update to version 3.5.14 or later. For Mozilla Firefox versions 3.6.x through 3.6.10, update to version 3.6.11 or later. For Thunderbird versions 3.0.x through 3.0.8, update to version 3.0.9 or later. For Thunderbird versions 3.1.x through 3.1.4, update to version 3.1.5 or later. For SeaMonkey versions 2.0.x through 2.0.8, update to version 2.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.12 Mozilla Firefox versions 3.6.x prior to 3.6.9 Thunderbird versions prior to 3.0.7 Thunderbird versions 3.1.x prior to 3.1.3 SeaMonkey versions prior to 2.0.7 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 3.5.12, update to version 3.5.12 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.9, update to version 3.6.9 or later. For Thunderbird versions prior to 3.0.7, update to version 3.0.7 or later. For Thunderbird versions 3.1.x prior to 3.1.3, update to version 3.1.3 or later. For SeaMonkey versions prior to 2.0.7, update to version 2.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.16 Mozilla Firefox versions 3.5.x prior to 3.5.6 SeaMonkey versions prior to 2.0.1 Thunderbird versions prior to 2.0.1 **Description** The issue affects the browser engine, allowing remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code. The exact vectors used for the attack are unknown. **Recommendations** For Mozilla Firefox versions prior to 3.0.16, update to version 3.0.16 or later. For Mozilla Firefox versions 3.5.x prior to 3.5.6, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later. For Thunderbird versions prior to 2.0.1, update to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.5 Thunderbird versions prior to 2.0.0.5 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.5, update to version 2.0.0.5 or later. For Thunderbird versions prior to 2.0.0.5, update to version 2.0.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5.x through 1.5.0.11 Mozilla Firefox versions 2.x through 2.0.0.3 Thunderbird versions 1.5.x through 1.5.0.11 Thunderbird versions 2.x through 2.0.0.3 SeaMonkey version 1.0.9 SeaMonkey version 1.1.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues. **Recommendations** For Mozilla Firefox versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Firefox versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For Thunderbird versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Thunderbird versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For SeaMonkey version 1.0.9, update to a version later than 1.0.9. For SeaMonkey version 1.1.2, update to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.10 Mozilla Firefox versions 2.x prior to 2.0.0.2 Thunderbird versions prior to 1.5.0.10 SeaMonkey versions prior to 1.0.8 **Description** The issue affects the layout engine, allowing remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For Mozilla Firefox versions 2.x prior to 2.0.0.2, update to version 2.0.0.2 or later. For Thunderbird versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** The issue affects the layout engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and potentially execute arbitrary code. The attack vectors for this issue are not specified. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.12 Thunderbird (affected versions not specified) libmozjs1d-dbg (affected versions not specified) libmozjs1d (affected versions not specified) libmozjs-dev (affected versions not specified) libmozillainterfaces-java (affected versions not specified) **Description** The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via various vectors related to the browser engine, including the frame chain, synchronous events, and other components. Exploitation of the vulnerabilities may lead to disruption of confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited remotely. **Recommendations** For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later. For Thunderbird, libmozjs1d-dbg, libmozjs1d, libmozjs-dev, and libmozillainterfaces-java, at the moment, there is no information about a newer version that contains a fix for this vulnerability.