Olli Pettay

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird ESR versions prior to 140.8 **Description** The software contains memory safety bugs that exhibit evidence of memory corruption. It is presumed that, with sufficient effort, these bugs could be exploited to execute arbitrary code. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird ESR to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 108 Firefox ESR versions prior to 102.6 Thunderbird versions prior to 102.6 **Description** The issue is related to memory safety bugs and buffer overflow, which could potentially allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. Some of these bugs showed evidence of memory corruption and it is presumed that with enough effort, some of these could have been exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 108, update to version 108 or later. For Firefox ESR versions prior to 102.6, update to version 102.6 or later. For Thunderbird versions prior to 102.6, update to version 102.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 91 Firefox ESR versions prior to 78.13 Thunderbird versions prior to 78.13 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with sufficient effort. It is also associated with a boundary error when processing HTML content, allowing a remote attacker to execute arbitrary code and cause memory damage. **Recommendations** For Firefox versions prior to 91, update to version 91 or later. For Firefox ESR versions prior to 78.13, update to version 78.13 or later. For Thunderbird versions prior to 78.13, update to version 78.13 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 90 Firefox ESR versions prior to 78.12 Thunderbird versions prior to 78.12 **Description** The issue is related to memory safety bugs present in code shared between Firefox and Thunderbird, which can lead to memory corruption. With sufficient effort, these bugs could potentially be exploited to run arbitrary code, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Firefox versions prior to 90, update to version 90 or later. For Firefox ESR versions prior to 78.12, update to version 78.12 or later. For Thunderbird versions prior to 78.12, update to version 78.12 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 Firefox ESR versions prior to 60.7 Thunderbird versions prior to 60.7 **Description** The issue is related to memory safety bugs, which can lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer data boundary operation issue, which can allow a remote attacker to cause a denial of service and disrupt data integrity. **Recommendations** For Firefox versions prior to 67, update to version 67 or later. For Firefox ESR versions prior to 60.7, update to version 60.7 or later. For Thunderbird versions prior to 60.7, update to version 60.7 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 59 Firefox ESR versions prior to 52.7 Thunderbird versions prior to 52.7 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to gain unauthorized access to information and compromise its integrity and availability. Memory safety bugs were reported, showing evidence of memory corruption, and it is presumed that these could be exploited to run arbitrary code with enough effort. **Recommendations** For Firefox versions prior to 59, update to version 59 or later to resolve the issue. For Firefox ESR versions prior to 52.7, update to version 52.7 or later to resolve the issue. For Thunderbird versions prior to 52.7, update to version 52.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 51 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For versions prior to 51, update to version 51 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50.1 Firefox ESR versions prior to 45.6 Thunderbird versions prior to 45.6 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 50.1, update to version 50.1 or later. For Firefox ESR versions prior to 45.6, update to version 45.6 or later. For Thunderbird versions prior to 45.6, update to version 45.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 49 and earlier Firefox ESR versions 45.4 and earlier Thunderbird versions prior to 45.5 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions 49 and earlier, update to version 50 or later. For Firefox ESR versions 45.4 and earlier, update to version 45.5 or later. For Thunderbird versions prior to 45.5, update to version 45.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 41.0 Mozilla Firefox ESR versions 38.x prior to 38.3 **Description** The issue is caused by buffer overflow, allowing a remote attacker to potentially execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash. **Recommendations** For Mozilla Firefox versions prior to 41.0, update to version 41.0 or later. For Mozilla Firefox ESR versions 38.x prior to 38.3, update to version 38.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 37.0 Firefox ESR versions 31.x prior to 31.6 Thunderbird versions prior to 31.6 **Description** The issue allows a remote attacker to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation. This can be achieved by exploiting the vulnerability in the affected software, allowing the attacker to perform actions with elevated privileges. **Recommendations** For Mozilla Firefox versions prior to 37.0, update to version 37.0 or later to resolve the issue. For Firefox ESR versions 31.x prior to 31.6, update to version 31.6 or later to resolve the issue. For Thunderbird versions prior to 31.6, update to version 31.6 or later to resolve the issue. As a temporary workaround, consider restricting access to anchor navigation in the affected software until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.13 Mozilla Firefox versions 3.6.x through 3.6.10 Thunderbird versions 3.0.x through 3.0.8 Thunderbird versions 3.1.x through 3.1.4 SeaMonkey versions 2.0.x through 2.0.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.13, update to version 3.5.14 or later. For Mozilla Firefox versions 3.6.x through 3.6.10, update to version 3.6.11 or later. For Thunderbird versions 3.0.x through 3.0.8, update to version 3.0.9 or later. For Thunderbird versions 3.1.x through 3.1.4, update to version 3.1.5 or later. For SeaMonkey versions 2.0.x through 2.0.8, update to version 2.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.12 Mozilla Firefox versions 3.6.x prior to 3.6.9 Thunderbird versions prior to 3.0.7 Thunderbird versions 3.1.x prior to 3.1.3 SeaMonkey versions prior to 2.0.7 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 3.5.12, update to version 3.5.12 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.9, update to version 3.6.9 or later. For Thunderbird versions prior to 3.0.7, update to version 3.0.7 or later. For Thunderbird versions 3.1.x prior to 3.1.3, update to version 3.1.3 or later. For SeaMonkey versions prior to 2.0.7, update to version 2.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.16 Mozilla Firefox versions 3.5.x prior to 3.5.6 SeaMonkey versions prior to 2.0.1 Thunderbird versions prior to 2.0.1 **Description** The issue affects the browser engine, allowing remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code. The exact vectors used for the attack are unknown. **Recommendations** For Mozilla Firefox versions prior to 3.0.16, update to version 3.0.16 or later. For Mozilla Firefox versions 3.5.x prior to 3.5.6, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later. For Thunderbird versions prior to 2.0.1, update to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.5 Thunderbird versions prior to 2.0.0.5 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.5, update to version 2.0.0.5 or later. For Thunderbird versions prior to 2.0.0.5, update to version 2.0.0.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5.x through 1.5.0.11 Mozilla Firefox versions 2.x through 2.0.0.3 Thunderbird versions 1.5.x through 1.5.0.11 Thunderbird versions 2.x through 2.0.0.3 SeaMonkey version 1.0.9 SeaMonkey version 1.1.2 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, via vectors related to dangling pointers, heap corruption, signed/unsigned, and other issues. **Recommendations** For Mozilla Firefox versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Firefox versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For Thunderbird versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Thunderbird versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For SeaMonkey version 1.0.9, update to a version later than 1.0.9. For SeaMonkey version 1.1.2, update to a version later than 1.1.2.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.10 Mozilla Firefox versions 2.x prior to 2.0.0.2 Thunderbird versions prior to 1.5.0.10 SeaMonkey versions prior to 1.0.8 **Description** The issue affects the layout engine, allowing remote attackers to cause a denial of service (crash) and potentially execute arbitrary code via certain vectors. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For Mozilla Firefox versions 2.x prior to 2.0.0.2, update to version 2.0.0.2 or later. For Thunderbird versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** The issue affects the layout engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and potentially execute arbitrary code. The attack vectors for this issue are not specified. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.12 Thunderbird (affected versions not specified) libmozjs1d-dbg (affected versions not specified) libmozjs1d (affected versions not specified) libmozjs-dev (affected versions not specified) libmozillainterfaces-java (affected versions not specified) **Description** The issue allows remote attackers to cause a denial of service or possibly execute arbitrary code via various vectors related to the browser engine, including the frame chain, synchronous events, and other components. Exploitation of the vulnerabilities may lead to disruption of confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited remotely. **Recommendations** For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later. For Thunderbird, libmozjs1d-dbg, libmozjs1d, libmozjs-dev, and libmozillainterfaces-java, at the moment, there is no information about a newer version that contains a fix for this vulnerability.