John Schoenick

**Name of the Vulnerable Software and Affected Versions** libcurl versions prior to 7.57.0 **Description** The issue is related to an out-of-bounds access flaw in SSL-related code. When allocating memory for a connection, the math used to calculate the extra memory amount necessary for the SSL library was incorrect on 32-bit systems, resulting in too little memory being allocated. This could lead to a crash or other undefined behaviors when accessing the last struct member of the last object within the memory area. The vulnerability is specifically present in 32-bit builds where `sizeof(long long *) < sizeof(long long)`. **Recommendations** For versions prior to 7.57.0, update to version 7.57.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of SSL-related functions in libcurl on 32-bit platforms until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 47.0 **Description** The issue allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading Style Sheets (CSS) pseudo-classes. This is related to the lack of protection for internal browser data. An attacker can exploit this to gain access to the full list of disabled plugins using CSS and pseudo-classes. **Recommendations** For versions prior to 47.0, update to version 47.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 15.0 Firefox ESR versions prior to 10.0.7 Thunderbird versions prior to 15.0 Thunderbird ESR versions prior to 10.0.7 SeaMonkey versions prior to 2.12 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 15.0, update to version 15.0 or later. For Firefox ESR versions prior to 10.0.7, update to version 10.0.7 or later. For Thunderbird versions prior to 15.0, update to version 15.0 or later. For Thunderbird ESR versions prior to 10.0.7, update to version 10.0.7 or later. For SeaMonkey versions prior to 2.12, update to version 2.12 or later.