Nika Layzell

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions 140.10 through 150 Firefox versions 150 and earlier Firefox ESR versions 115.35 through 140.10 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Thunderbird to version 151 or 140.11. Update Firefox to version 151. Update Firefox ESR to version 115.36 or 140.11.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 140.10 through 150 Thunderbird versions 140.10 through 150 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Firefox to version 151 or ESR 140.11. Update Thunderbird to version 151 or 140.11.

**Name of the Vulnerable Software and Affected Versions** Thunderbird version 150 Firefox version 150 **Description** Memory safety bugs involving memory corruption may allow an attacker to execute arbitrary code. **Recommendations** Update Thunderbird to version 151. Update Firefox to version 151.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Thunderbird versions prior to 149 **Description** A privilege escalation issue exists in the Inter-Process Communication (IPC) component. This allows for potential unauthorized access and control within the system. **Recommendations** Update Firefox to version 149 or later. Update Thunderbird to version 149 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 138 Firefox ESR versions prior to 128.10 Firefox ESR versions prior to 115.23 Thunderbird versions prior to 138 Thunderbird ESR versions prior to 128.10 **Description** A process isolation issue stems from improper handling of `javascript:` URIs, potentially allowing content to execute in the top-level document's process instead of the intended frame. This could enable a sandbox escape. **Recommendations** For Firefox versions prior to 138, update to version 138 or later. For Firefox ESR versions prior to 128.10, update to version 128.10 or later. For Firefox ESR versions prior to 115.23, update to version 115.23 or later. For Thunderbird versions prior to 138, update to version 138 or later. For Thunderbird ESR versions prior to 128.10, update to version 128.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 122 **Description** The issue is related to a use-after-free error, which could potentially allow a remote attacker to execute arbitrary code. On macOS, this could occur if a Firefox update is being applied on a very busy system, resulting in an exploitable crash. **Recommendations** For versions prior to 122, update to version 122 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3 **Description** The issue is related to memory safety bugs, which have shown evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer overflow in memory, which could allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 116 Firefox ESR versions prior to 102.14 Firefox ESR versions prior to 115.1 **Description** The issue is related to the use of memory after it has been freed, which could allow a remote attacker to execute arbitrary code. This is due to race conditions found in reference counting code. The vulnerability affects Firefox and Firefox ESR browsers. **Recommendations** For Firefox versions prior to 116, update to version 116 or later. For Firefox ESR versions prior to 102.14, update to version 102.14 or later. For Firefox ESR versions prior to 115.1, update to version 115.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 113 Firefox ESR (affected versions not specified) **Description** The issue is related to insufficient access control to certain functions, which could allow a remote attacker to load a document with higher privileges than intended. This is due to the incorrect assumption of the ordering of principal objects when loading a privileged principal. **Recommendations** For Firefox versions prior to 113, update to version 113 or later to resolve the issue. For Firefox ESR, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 109 **Description** The issue is related to the implementation of the ParseFromSafeString() function in the DOMParser interface of Mozilla Firefox. It involves the incorrect creation of a duplicate SystemPrincipal object when handling html documents. This could allow a remote attacker to bypass security restrictions. **Recommendations** For versions prior to 109, update to version 109 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DOMParser::ParseFromSafeString function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 108 Firefox ESR versions prior to 102.6 Thunderbird versions prior to 102.6 **Description** The issue is related to insufficient protection of internal data, allowing an attacker who compromised a content process to partially escape the sandbox and read arbitrary files via clipboard-related IPC messages. This could enable a remote attacker to bypass security restrictions and gain unauthorized access to protected information by sending specially crafted IPC messages. **Recommendations** For Firefox versions prior to 108, update to version 108 or later. For Firefox ESR versions prior to 102.6, update to version 102.6 or later. For Thunderbird versions prior to 102.6, update to version 102.6 or later. As a temporary workaround, consider restricting access to clipboard-related IPC messages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 105 Firefox ESR versions prior to 102.3 Thunderbird versions prior to 102.3 **Description** The issue is related to memory safety bugs, which could potentially be exploited to run arbitrary code. These bugs showed evidence of memory corruption. The vulnerability can be exploited by a remote attacker using a specially crafted website, potentially leading to memory damage and arbitrary code execution in the target system. **Recommendations** For Firefox versions prior to 105, update to version 105 or later. For Firefox ESR versions prior to 102.3, update to version 102.3 or later. For Thunderbird versions prior to 102.3, update to version 102.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 104 Firefox ESR versions prior to 102.2 Thunderbird versions prior to 102.2 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also associated with a JavaScript scripting engine handler vulnerability that involves buffer copying without checking the size of input data. This could allow a remote attacker to execute arbitrary code by opening a specially crafted malicious web page. **Recommendations** For Firefox versions prior to 104, update to version 104 or later. For Firefox ESR versions prior to 102.2, update to version 102.2 or later. For Thunderbird versions prior to 102.2, update to version 102.2 or later.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 91.8 Firefox versions prior to 99 Firefox ESR versions prior to 91.8 **Description** The issue is related to memory safety bugs and buffer overflow, which can lead to memory corruption. It is presumed that with enough effort, these bugs could be exploited to run arbitrary code. The vulnerability can be exploited by a remote attacker using a specially crafted web page, potentially allowing them to execute arbitrary code on the target system. **Recommendations** For Thunderbird versions prior to 91.8, update to version 91.8 or later. For Firefox versions prior to 99, update to version 99 or later. For Firefox ESR versions prior to 91.8, update to version 91.8 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 88 Firefox ESR versions prior to 78.10 Thunderbird versions prior to 78.10 Description: The issue is related to errors in inherited permissions, which can be exploited by a remote attacker using a specially crafted Blob URL to elevate privileges. If a Blob URL was loaded through unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content. Recommendations: For Firefox versions prior to 88, update to version 88 or later to resolve the issue. For Firefox ESR versions prior to 78.10, update to version 78.10 or later to resolve the issue. For Thunderbird versions prior to 78.10, update to version 78.10 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 86 Thunderbird versions prior to 78.8 Firefox ESR versions prior to 78.8 Description: The issue is related to memory safety bugs present in certain versions of Firefox and Thunderbird, which could potentially be exploited to run arbitrary code due to evidence of memory corruption. Recommendations: For Firefox versions prior to 86, update to version 86 or later. For Thunderbird versions prior to 78.8, update to version 78.8 or later. For Firefox ESR versions prior to 78.8, update to version 78.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 62 Firefox ESR versions prior to 60.2 Thunderbird versions prior to 60.2.1 **Description** The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. This affects various versions of Firefox, Firefox ESR, and Thunderbird. **Recommendations** For Firefox versions prior to 62, update to version 62 or later. For Firefox ESR versions prior to 60.2, update to version 60.2 or later. For Thunderbird versions prior to 60.2.1, update to version 60.2.1 or later.