Masatoshi Kimura

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.16 Mozilla Firefox versions 3.6.x prior to 3.6.13 SeaMonkey versions prior to 2.0.11 **Description** The issue allows remote attackers to inject arbitrary web script or HTML via specific characters that may be converted to angle brackets during rendering, including `x-mac-arabic`, `x-mac-farsi`, or `x-mac-hebrew` characters. **Recommendations** For Mozilla Firefox versions prior to 3.5.16, update to version 3.5.16 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.13, update to version 3.6.13 or later. For SeaMonkey versions prior to 2.0.11, update to version 2.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Thunderbird versions prior to 1.5.0.4 SeaMonkey versions prior to 1.0.2 **Description** A double free issue exists in the nsVCard.cpp component, allowing remote attackers to potentially cause a denial of service or execute arbitrary code by sending a VCard with invalid base64 characters. **Recommendations** For Mozilla Thunderbird versions prior to 1.5.0.4, update to version 1.5.0.4 or later. For SeaMonkey versions prior to 1.0.2, update to version 1.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.4 Mozilla Thunderbird versions prior to 1.5.0.4 **Description** The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via a Unicode Byte-order-Mark (BOM) sequence in the middle of a dangerous tag such as SCRIPT. This occurs because the software strips the BOM from a UTF-8 page before it is passed to the parser. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue. For Mozilla Thunderbird versions prior to 1.5.0.4, update to version 1.5.0.4 or later to resolve the issue.