Paul Nickerson

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 115 **Description** The issue is related to insufficient validation in the Drag and Drop API, which, when combined with social engineering, may allow an attacker to trick end-users into creating a shortcut to local system files. This could potentially be leveraged to execute arbitrary code. **Recommendations** For versions prior to 115, update to version 115 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Drag and Drop API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8 **Description** The issue allows remote attackers to cause a denial of service and possibly trigger memory corruption via certain vectors related to specific methods, including `nsTableFrame::GetFrameAtOrBefore`, `nsAccessibilityService::GetAccessible`, `nsBindingManager::GetNestedInsertionPoint`, `nsXBLPrototypeBinding::AttributeChanged`, `nsColumnSetFrame::GetContentInsertionFrame`, and `nsLineLayout::TrimTrailingWhiteSpaceIn`. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.5 Thunderbird versions prior to 2.0.0.5 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.5, update to version 2.0.0.5 or later. For Thunderbird versions prior to 2.0.0.5, update to version 2.0.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.4 Mozilla Thunderbird versions prior to 1.5.0.4 **Description** The issue allows remote attackers to execute code at a higher privilege than intended due to certain privileged UI code calling content-defined setters on an object prototype. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.4, update to version 1.5.0.4 or later. For Mozilla Thunderbird versions prior to 1.5.0.4, update to version 1.5.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.4 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML by tricking a user into performing specific actions, such as viewing a broken image with a Javascript URL in the SRC attribute or selecting "Show only this frame" on a frame with a Javascript URL in its SRC attribute. **Recommendations** For versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.4 **Description** The issue allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested `javascript:` URLs. This would not cross privilege boundaries if the user installs malicious software from the attacker-controlled site. **Recommendations** For versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the "Manual Install" button for plugin installation until a patch is applied. Restrict access to untrusted websites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.17 Mozilla Firefox 3.x versions prior to 3.0.2 SeaMonkey versions prior to 1.1.12 **Description** The issue allows user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls `window.moveBy`. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.17, update to version 2.0.0.17 or later. For Mozilla Firefox 3.x versions prior to 3.0.2, update to version 3.0.2 or later. For SeaMonkey versions prior to 1.1.12, update to version 1.1.12 or later.