Annevk

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 119 **Description** The issue is related to insufficient protection of service data when processing the Vary header response for matching request headers. An attacker can exploit this by sending iterative requests to learn the size of an opaque response and the contents of a server-supplied Vary header, potentially allowing unauthorized access to protected information. **Recommendations** For versions prior to 119, update to Firefox version 119 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 41.0 Mozilla Firefox ESR versions 38.x prior to 38.3 **Description** The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect. **Recommendations** For Mozilla Firefox versions prior to 41.0, update to version 41.0 or later to resolve the issue. For Mozilla Firefox ESR versions 38.x prior to 38.3, update to version 38.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript code in the browser until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 11.0 Firefox ESR versions 10.x before 10.0.4 Thunderbird versions 5.0 through 11.0 Thunderbird ESR versions 10.x before 10.0.4 SeaMonkey versions prior to 2.9 **Description** A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. This can be exploited by remote attackers. **Recommendations** For Mozilla Firefox versions 4.x through 11.0, update to a version after 11.0. For Firefox ESR versions 10.x before 10.0.4, update to version 10.0.4 or later. For Thunderbird versions 5.0 through 11.0, update to a version after 11.0. For Thunderbird ESR versions 10.x before 10.0.4, update to version 10.0.4 or later. For SeaMonkey versions prior to 2.9, update to version 2.9 or later.