Tom Schuster

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions 140.10 through 150 Firefox versions 150 and earlier Firefox ESR versions 115.35 through 140.10 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Thunderbird to version 151 or 140.11. Update Firefox to version 151. Update Firefox ESR to version 115.36 or 140.11.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 140.10 through 150 Thunderbird versions 140.10 through 150 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Firefox to version 151 or ESR 140.11. Update Thunderbird to version 151 or 140.11.

**Name of the Vulnerable Software and Affected Versions** Thunderbird version 150 Firefox version 150 **Description** Memory safety bugs involving memory corruption may allow an attacker to execute arbitrary code. **Recommendations** Update Thunderbird to version 151. Update Firefox to version 151.

**Name of the Vulnerable Software and Affected Versions** Firefox version 150.0.1 Firefox ESR version 140.10.1 Firefox ESR version 115.35.1 **Description** Memory safety bugs exist that exhibit evidence of memory corruption, which could potentially be exploited to execute arbitrary code. **Recommendations** Update Firefox 150.0.1 to version 150.0.2. Update Firefox ESR 140.10.1 to version 140.10.2. Update Firefox ESR 115.35.1 to version 115.35.2.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR version 140.9 Thunderbird ESR version 140.9 Firefox version 149 Thunderbird version 149 **Description** Memory safety bugs involving memory corruption could allow an attacker to run arbitrary code. **Recommendations** Update Firefox ESR to version 140.10. Update Thunderbird ESR to version 140.10. Update Firefox to version 150. Update Thunderbird to version 150.

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149.0.2 Firefox ESR versions prior to 115.34.1 and 140.9.1 Thunderbird versions prior to 149.0.2 and 140.9.1 Description Memory safety bugs are present in Firefox and Thunderbird, with some showing evidence of memory corruption. These bugs could potentially be exploited to run arbitrary code. Recommendations Update Firefox to version 149.0.2 or later. Update Firefox ESR to version 115.34.1 or 140.9.1 or later. Update Thunderbird to version 149.0.2 or later. Update Thunderbird ESR to version 140.9.1 or later.

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149.0.2 Firefox ESR versions prior to 140.9.1 Thunderbird versions prior to 149.0.2 Thunderbird ESR versions prior to 140.9.1 Description Memory safety bugs are present in Firefox and Thunderbird, potentially leading to memory corruption and arbitrary code execution. These bugs were identified in versions ESR 140.9.0, 140.9.0, 149.0.1, and 149.0.1. Recommendations Update Firefox to version 149.0.2 or later. Update Firefox ESR to version 140.9.1 or later. Update Thunderbird to version 149.0.2 or later. Update Thunderbird ESR to version 140.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Thunderbird versions prior to 149 **Description** Memory safety issues exist in Firefox 148 and Thunderbird 148. These bugs demonstrate evidence of memory corruption, and it is presumed that, with sufficient effort, they could potentially be exploited to execute arbitrary code. **Recommendations** Update Firefox to version 149 or later. Update Thunderbird to version 149 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Thunderbird versions prior to 148 **Description** The software contains memory safety bugs. Some of these bugs exhibited evidence of memory corruption, and it is presumed that, with sufficient effort, they could potentially be exploited to execute arbitrary code. **Recommendations** Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Firefox ESR versions 115.33 through 140.8 Thunderbird versions prior to 149 Thunderbird ESR versions 140.8 through 140.9 **Description** The software contains memory safety bugs, some of which demonstrate evidence of memory corruption. It is presumed that, with sufficient effort, these bugs could potentially be exploited to execute arbitrary code. **Recommendations** Update Firefox to version 149 or later. Update Firefox ESR to version 115.34 or later, or version 140.9 or later. Update Thunderbird to version 149 or later. Update Thunderbird ESR to version 140.9 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 141 Firefox ESR versions prior to 128.13 Firefox ESR versions prior to 140.1 Thunderbird versions prior to 141 Thunderbird versions prior to 128.13 Thunderbird versions prior to 140.1 **Description** The `username:password` component was not properly removed from URLs within Content Security Policy (CSP) reports, potentially exposing HTTP Basic Authentication credentials. **Recommendations** Update Firefox to version 141 or later. Update Firefox ESR to version 128.13 or later. Update Firefox ESR to version 140.1 or later. Update Thunderbird to version 141 or later. Update Thunderbird to version 128.13 or later. Update Thunderbird to version 140.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 121 **Description** The issue is related to inadequate exception handling in Mozilla Firefox, which can be exploited by a remote attacker to cause a denial of service. Specifically, `TypedArrays` can be fallible and lack proper exception handling, potentially leading to abuse in other APIs that expect `TypedArrays` to always succeed. **Recommendations** For versions prior to 121, update to version 121 or later to resolve the issue. As a temporary workaround, consider restricting the use of `TypedArrays` in affected APIs until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 109 Thunderbird versions prior to 102.7 Firefox ESR versions prior to 102.7 **Description** The issue arises from the Firefox GTK wrapper code's use of text/plain for drag data, which GTK treats as being dragged if the text/plain MIME contains file URLs. This allows a website to arbitrarily read a file via a call to `DataTransfer.setData`. **Recommendations** For Firefox versions prior to 109, update to version 109 or later to resolve the issue. For Thunderbird versions prior to 102.7, update to version 102.7 or later to resolve the issue. For Firefox ESR versions prior to 102.7, update to version 102.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `DataTransfer.setData` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions 50.1 and earlier Firefox ESR versions 45.6 and earlier Thunderbird versions prior to 45.7 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions 50.1 and earlier, update to version 51 or later. For Firefox ESR versions 45.6 and earlier, update to version 45.7 or later. For Thunderbird versions prior to 45.7, update to version 45.7 or later.