Curtis Koenig

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 32.0 Mozilla Firefox ESR versions 24.x prior to 24.8 and 31.x prior to 31.1 Thunderbird versions 24.x prior to 24.8 and 31.x prior to 31.1 **Description** The issue allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. This occurs due to a use-after-free vulnerability in DirectionalityUtils.cpp. **Recommendations** For Mozilla Firefox versions prior to 32.0, update to version 32.0 or later. For Mozilla Firefox ESR versions 24.x prior to 24.8, update to version 24.8 or later. For Mozilla Firefox ESR versions 31.x prior to 31.1, update to version 31.1 or later. For Thunderbird versions 24.x prior to 24.8, update to version 24.8 or later. For Thunderbird versions 31.x prior to 31.1, update to version 31.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox version 12.0 Thunderbird version 12.0 SeaMonkey version 2.9 **Description** The issue allows local users to gain privileges by loading a DLL file in a privileged context, affecting Mozilla Firefox, Thunderbird, and SeaMonkey on Windows. **Recommendations** For Mozilla Firefox version 12.0, consider restricting the loading of DLL files in privileged contexts until a patch is available. For Thunderbird version 12.0, restrict the loading of DLL files in privileged contexts to minimize the risk of exploitation. For SeaMonkey version 2.9, avoid using privileged contexts that may load DLL files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.