Steven Michaud

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 150 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 **Description** A use-after-free issue exists in the Widget: Cocoa component. Use-after-free occurs when an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution. **Recommendations** Update to version 150 Update to version 140.10 Update to version 150 Update to version 140.10

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 139.0.4 **Description** Certain canvas operations could have led to memory corruption. **Recommendations** For versions prior to 139.0.4, update to version 139.0.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 34.0 Firefox ESR versions prior to 31.3 Thunderbird versions prior to 31.3 **Description** The issue allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information, due to the omission of a CoreGraphics disable-logging action needed by jemalloc-based applications. **Recommendations** For Mozilla Firefox versions prior to 34.0, update to version 34.0 or later. For Firefox ESR versions prior to 31.3, update to version 31.3 or later. For Thunderbird versions prior to 31.3, update to version 31.3 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.7.2 **Description** The issue is related to a buffer overflow in the ATSFontDeactivate API within Apple Type Services (ATS) in Apple Mac OS X. This allows remote attackers to potentially execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors. **Recommendations** For versions prior to 10.7.2, update to version 10.7.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.16 Mozilla Firefox versions 3.6.x prior to 3.6.13 SeaMonkey versions prior to 2.0.11 **Description** The issue arises from improper handling of certain redirections involving data: URLs and Java LiveConnect scripts. This allows remote attackers to start processes, read arbitrary local files, and establish network connections. The attack vector involves a refresh value in the http-equiv attribute of a META element, causing the wrong security principal to be used. **Recommendations** For Mozilla Firefox versions prior to 3.5.16, update to version 3.5.16 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.13, update to version 3.6.13 or later. For SeaMonkey versions prior to 2.0.11, update to version 2.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** A use-after-free issue in the LiveConnect bridge code allows remote attackers to cause a denial of service, resulting in a crash, via unknown vectors. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.