Igor Bukanov

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 81.0.4044.92 **Description** The issue is related to a use after free in window management, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. **Recommendations** For Google Chrome versions prior to 81.0.4044.92, update to version 81.0.4044.92 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted HTML pages that could trigger the exploitation of heap corruption until a patch is applied. Restrict access to sensitive data and monitor for any signs of unauthorized access or service disruption.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.17 Mozilla Firefox versions 3.6.x prior to 3.6.14 SeaMonkey versions prior to 2.0.12 **Description** A use-after-free issue in the JSON.stringify method might allow remote attackers to execute arbitrary code via unspecified vectors related to the `js HasOwnProperty` function and garbage collection. **Recommendations** For Mozilla Firefox versions prior to 3.5.17, update to version 3.5.17 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.14, update to version 3.6.14 or later. For SeaMonkey versions prior to 2.0.12, update to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.6.x prior to 3.6.13 Thunderbird versions 3.1.x prior to 3.1.7 **Description** The issue allows remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.6.x prior to 3.6.13, update to version 3.6.13 or later. For Thunderbird versions 3.1.x prior to 3.1.7, update to version 3.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.5 SeaMonkey versions prior to 2.0.1 Thunderbird versions prior to 2.0.1 **Description** The issue is related to multiple unspecified vulnerabilities in the JavaScript engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.5, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later. For Thunderbird versions prior to 2.0.1, update to version 2.0.1 or later.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 Thunderbird versions prior to 2.0.0.22 SeaMonkey versions prior to 1.1.17 Description: The issue allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via certain vectors. These vectors are related to `js LeaveSharpObject`, `ParseXMLSource`, and a certain assertion in `jsinterp.c`. Recommendations: For Mozilla Firefox versions prior to 3.0.11, update to version 3.0.11 or later. For Thunderbird versions prior to 2.0.0.22, update to version 2.0.0.22 or later. For SeaMonkey versions prior to 1.1.17, update to version 1.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.x through 3.0.8 Thunderbird versions 2.x through 2.0.0.21 SeaMonkey versions 1.x through 1.1.15 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and may also trigger memory corruption. This is achieved through vectors involving the `js FindPropertyHelper` function, which is related to the definitions of `Math` and `Date`, as well as the `js CheckRedeclaration` function. **Recommendations** For Mozilla Firefox versions 3.x through 3.0.8, update to version 3.0.9 or later. For Thunderbird versions 2.x through 2.0.0.21, update to version 2.0.0.22 or later. For SeaMonkey versions 1.x through 1.1.15, update to version 1.1.16 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.9 Thunderbird versions prior to 2.0.0.22 SeaMonkey versions prior to 1.1.16 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and may also trigger memory corruption. This is achieved through specific vectors involving `JSOP DEFVAR` and properties that lack the `JSPROP PERMANENT` attribute. **Recommendations** For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later. For Thunderbird versions prior to 2.0.0.22, update to version 2.0.0.22 or later. For SeaMonkey versions prior to 1.1.16, update to version 1.1.16 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** The issue is related to the layout engine and can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** The issue is related to the JavaScript engine and can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via certain vectors, including large switch statements, specific uses of `watch` and `eval`, and certain uses of the `mousedown` event listener. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5.x through 1.5.0.11 Mozilla Firefox versions 2.x through 2.0.0.3 Mozilla Thunderbird versions 1.5.x through 1.5.0.11 Mozilla Thunderbird versions 2.x through 2.0.0.3 SeaMonkey version 1.0.9 SeaMonkey version 1.1.2 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger memory corruption in the JavaScript engine. **Recommendations** For Mozilla Firefox versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Firefox versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For Mozilla Thunderbird versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Thunderbird versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For SeaMonkey version 1.0.9 and 1.1.2, update to a version that is not affected by this issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.10 Mozilla Firefox versions 2.x prior to 2.0.0.2 Thunderbird versions prior to 1.5.0.10 SeaMonkey versions prior to 1.0.8 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption in the JavaScript engine. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For Mozilla Firefox versions 2.x prior to 2.0.0.2, update to version 2.0.0.2 or later. For Thunderbird versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 Mozilla versions 1.7 and earlier **Description** The issue affects the JavaScript engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and possibly execute arbitrary code. The exact attack vectors are unknown. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later. For Mozilla versions 1.7 and earlier, update to a version later than 1.7.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 1.5.0.8 Thunderbird versions prior to 1.5.0.8 SeaMonkey versions prior to 1.0.6 Description: The issue is related to multiple unspecified vulnerabilities in the JavaScript engine. These vulnerabilities can be exploited by remote attackers to cause a denial of service, potentially leading to a crash, and may also allow the execution of arbitrary code. The exploitation is triggered by unspecified vectors that result in memory corruption. Recommendations: For Mozilla Firefox versions prior to 1.5.0.8, update to version 1.5.0.8 or later. For Thunderbird versions prior to 1.5.0.8, update to version 1.5.0.8 or later. For SeaMonkey versions prior to 1.0.6, update to version 1.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.5 Thunderbird versions prior to 1.5.0.5 SeaMonkey versions prior to 1.0.3 **Description** The issue is related to the Javascript engine, which might allow remote attackers to execute arbitrary code. This is due to vectors involving garbage collection that causes deletion of a temporary object that is still being used. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For Thunderbird versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For SeaMonkey versions prior to 1.0.3, update to version 1.0.3 or later.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.x before 1.5 Mozilla Thunderbird versions 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite versions prior to 1.7.13 SeaMonkey versions prior to 1.0 Description: The issue is related to the JavaScript engine's handling of temporary variables that are not properly garbage collected. This could potentially allow remote attackers to trigger operations on freed memory, leading to memory corruption. Recommendations: For Mozilla Firefox versions 1.x before 1.5, update to version 1.5 or later. For Mozilla Thunderbird versions 1.x before 1.5, update to version 1.5 or later. For Mozilla Thunderbird versions 1.0.x before 1.0.8, update to version 1.0.8 or later. For Mozilla Suite versions prior to 1.7.13, update to version 1.7.13 or later. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla and Firefox versions prior to 1.5.1 **Description** The issue is related to the Javascript interpreter in Mozilla and Firefox, which does not properly dereference objects. This can be exploited by remote attackers to cause a denial of service, resulting in a crash, or to execute arbitrary code. The attack vectors are related to garbage collection, although the specifics are not detailed. **Recommendations** For versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox version 1.5 **Description** The issue is related to the function allocation code in Firefox, specifically the js NewFunction in jsfun.c, which allows attackers to cause a denial of service and possibly execute arbitrary code. This is achieved through user-defined methods that trigger garbage collection in a way that operates on freed objects. **Recommendations** For Firefox version 1.5, consider disabling the js NewFunction until a patch is available. Restrict the use of user-defined methods that could trigger garbage collection to minimize the risk of exploitation.