Nicolas B. Pierron

**Name of the Vulnerable Software and Affected Versions** Firefox versions 100 and earlier Firefox ESR versions 91.9 and earlier Thunderbird versions 91.9 and earlier **Description** The issue is related to memory safety bugs, which could potentially be exploited to run arbitrary code. It is also associated with a buffer copy without checking the size of the input data, allowing a remote attacker to cause a denial of service or execute arbitrary code. **Recommendations** For Firefox versions 100 and earlier, update to version 101 or later. For Firefox ESR versions 91.9 and earlier, update to version 91.10 or later. For Thunderbird versions 91.9 and earlier, update to version 91.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 64 Firefox ESR versions prior to 60.4 Thunderbird versions prior to 60.4 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 64, update to version 64 or later. For Firefox ESR versions prior to 60.4, update to version 60.4 or later. For Thunderbird versions prior to 60.4, update to version 60.4 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 60 and earlier Firefox ESR versions 60 and earlier, 52.8 and earlier Thunderbird versions 60 and earlier, 52.9 and earlier **Description** The issue is caused by memory safety bugs, including buffer overflow in memory, which can lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be exploited to run arbitrary code. This can be achieved by a remote attacker using a specially crafted web page. **Recommendations** For Firefox versions 60 and earlier, update to version 61 or later. For Firefox ESR versions 60 and earlier, update to version 60.1 or later. For Firefox ESR versions 52.8 and earlier, update to version 52.9 or later. For Thunderbird versions 60 and earlier, update to version 60.1 or later. For Thunderbird versions 52.9 and earlier, update to version 52.9.1 or later. As a temporary workaround, consider restricting access to potentially vulnerable web pages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 60 Firefox ESR (affected versions not specified) **Description** The issue is related to errors in privilege management. It may allow a remote attacker to elevate their privileges and execute arbitrary code. If an attacker has already gained control over a content process using another vulnerability, they may be able to replace JavaScript code in the JavaScript Start-up Bytecode Cache (JSBC), potentially escaping the sandbox and executing scripts with elevated privileges. **Recommendations** For Firefox versions prior to 60, update to version 60 or later to resolve the issue. For Firefox ESR, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 56 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 56, update to version 56 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 43.0 **Description** The issue is caused by a buffer overflow in the XDRBuffer::grow function, located in js/src/vm/Xdr.cpp. This can be exploited by remote attackers using specially crafted JavaScript code, potentially leading to a denial of service or other unspecified impacts. **Recommendations** For versions prior to 43.0, update to version 43.0 or later to resolve the issue. As a temporary workaround, consider restricting the execution of crafted JavaScript code until the update is applied.