Mats Palmgren

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 86 Thunderbird versions prior to 78.8 Firefox ESR versions prior to 78.8 Description: The issue is related to memory safety bugs present in certain versions of Firefox and Thunderbird, which could potentially be exploited to run arbitrary code due to evidence of memory corruption. Recommendations: For Firefox versions prior to 86, update to version 86 or later. For Thunderbird versions prior to 78.8, update to version 78.8 or later. For Firefox ESR versions prior to 78.8, update to version 78.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 62 Firefox ESR versions prior to 60.2 Thunderbird versions prior to 60.2.1 **Description** The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. This affects various versions of Firefox, Firefox ESR, and Thunderbird. **Recommendations** For Firefox versions prior to 62, update to version 62 or later. For Firefox ESR versions prior to 60.2, update to version 60.2 or later. For Thunderbird versions prior to 60.2.1, update to version 60.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 54 ALT Linux (affected versions not specified) **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 54, update to version 54 or later to resolve the issue. At the moment, there is no information about a fix for ALT Linux.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 54 Firefox ESR versions prior to 52.2 Thunderbird versions prior to 52.2 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. The vulnerability is associated with a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 54, update to version 54 or later. For Firefox ESR versions prior to 52.2, update to version 52.2 or later. For Thunderbird versions prior to 52.2, update to version 52.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 53 Firefox ESR versions prior to 45.9 Firefox ESR versions prior to 52.1 Thunderbird versions prior to 52.1 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 53, update to version 53 or later. For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Thunderbird versions prior to 52.1, update to version 52.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50 **Description** The issue allows a "<select>" dropdown menu to cover location bar content, potentially leading to spoofing attacks. This attack requires e10s to be enabled in order to function. **Recommendations** For versions prior to 50, update to version 50 or later to resolve the issue. As a temporary workaround, consider disabling e10s until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 18.0 Firefox ESR versions prior to 10.0.12 and prior to 17.0.1 Thunderbird versions prior to 17.0.2 Thunderbird ESR versions prior to 10.0.12 and prior to 17.0.1 SeaMonkey versions prior to 2.15 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 18.0, update to version 18.0 or later. For Firefox ESR versions prior to 10.0.12, update to version 10.0.12 or later. For Firefox ESR versions prior to 17.0.1, update to version 17.0.1 or later. For Thunderbird versions prior to 17.0.2, update to version 17.0.2 or later. For Thunderbird ESR versions prior to 10.0.12, update to version 10.0.12 or later. For Thunderbird ESR versions prior to 17.0.1, update to version 17.0.1 or later. For SeaMonkey versions prior to 2.15, update to version 2.15 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8 **Description** The issue allows remote attackers to cause a denial of service and possibly trigger memory corruption via certain vectors related to specific methods, including `nsTableFrame::GetFrameAtOrBefore`, `nsAccessibilityService::GetAccessible`, `nsBindingManager::GetNestedInsertionPoint`, `nsXBLPrototypeBinding::AttributeChanged`, `nsColumnSetFrame::GetContentInsertionFrame`, and `nsLineLayout::TrimTrailingWhiteSpaceIn`. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.5 Thunderbird versions prior to 2.0.0.5 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.5, update to version 2.0.0.5 or later. For Thunderbird versions prior to 2.0.0.5, update to version 2.0.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 1.0.7 Mozilla Suite versions prior to 1.7.12 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Unicode sequences with "zero-width non-joiner" characters. **Recommendations** For Firefox versions prior to 1.0.7, update to version 1.0.7 or later. For Mozilla Suite versions prior to 1.7.12, update to version 1.7.12 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 1.5.0.7 Thunderbird versions prior to 1.5.0.7 SeaMonkey versions prior to 1.0.5 libnspr4 (affected versions not specified) libnss3 (affected versions not specified) libnspr-dev (affected versions not specified) libnss-dev (affected versions not specified) **Description** The issue involves multiple unspecified vulnerabilities that can be exploited remotely, potentially leading to a denial of service, memory corruption, and possibly the execution of arbitrary code. This can be achieved via unspecified vectors, some of which may involve JavaScript, large images, or plugin data. The vulnerabilities can compromise the confidentiality, integrity, and availability of protected information. **Recommendations** For Firefox versions prior to 1.5.0.7, update to version 1.5.0.7 or later. For Thunderbird versions prior to 1.5.0.7, update to version 1.5.0.7 or later. For SeaMonkey versions prior to 1.0.5, update to version 1.0.5 or later. For libnspr4, libnss3, libnspr-dev, and libnss-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability.