Package Instance

Security researcher Gregory Fleischer reported
that when an Adobe Flash file is loaded via
the view-source: scheme, the Flash plugin misinterprets
the origin of the content as localhost, leading to two specific
vulnerabilities:

Mozilla security researcher moz_bug_r_a4 reported that frame
scripts bypass XPConnect security checks when calling untrusted objects. This
allows for cross-site scripting (XSS) attacks through web pages and Firefox
extensions. The fix enables the Script Security Manager (SSM) to force security
checks on all frame scripts.
Firefox 3.6 and Thunderbird 3.1 are not affected by this
vulnerability.

Mozilla developer Blake Kaplan reported that the 
window.location object was made a normal overridable JavaScript object
in the Firefox 3.6 browser engine (Gecko 1.9.2) because new mechanisms
were developed to enforce the same-origin policy between windows and frames.
This object is unfortunately also used by some plugins to determine the page
origin used for access restrictions. A malicious page could override this
object to fool a plugin into granting access to data on another site or the
local file system. The behavior of older Firefox versions has been restored.
This flaw does not affect earlier versions of Firefox, or other
programs such as Thunderbird or SeaMonkey built on older versions
of the browser engine.

Mozilla developers and community members identified and fixed
several stability bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these crashes showed evidence of
memory corruption under certain circumstances and we presume that with
enough effort at least some of these could be exploited to run
arbitrary code.

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series critically rated of use-after-free and buffer overflow issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting five additional use-after-free, out of bounds read, and buffer overflow flaws introduced during Firefox development that were fixed before general release. 
In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Mozilla developers identified and fixed several memory safety bugs
in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption
under certain circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the Thunderbird
and SeaMonkey products because scripting is disabled,, but are potentially a risk
in browser or browser-like contexts in those products.

Security researcher Arthur Gerkis used the Address Sanitizer
tool to find a use-after-free in nsGlobalWindow::PageHidden when mFocusedContent
is released and oldFocusedContent is used afterwards. This use-after-free could
possibly allow for remote code execution.

Security researcher Arthur Gerkis used the Address Sanitizer
tool to find a use-after-free while replacing/inserting a node in a document.
This use-after-free could possibly allow for remote code execution.

Mozilla community member Michael reported that
when a server responds with a Refresh header containing a
javascript: URI, Firefox will redirect to the javascript: URI.  If an
attacker could inject a Refresh header into a server
response, or could control the value that a site places in
the Refresh header, they could use this vulnerability to
perform an XSS attack and execute arbitrary JavaScript within the
context of that site.

Ian Graham of Citrix Online reported that when multiple
Location headers were present in a redirect response 
Mozilla behavior differed from other browsers: Mozilla would use the second
Location header while Chrome and Internet Explorer would use
the first. Two copies of this header with different values could be a symptom
of a CRLF injection attack against a vulnerable server. Most commonly it is
the Location header itself that is vulnerable to the response
splitting and therefore the copy preferred by Mozilla is more likely to be
the malicious one. It is possible, however, that the first copy was the
injected one depending on the nature of the server vulnerability.
The Mozilla browser engine has been changed to treat two copies of this
header with different values as an error condition. The same has been done
with the headers Content-Length and Content-Disposition

Security researcher Kaspar Brand found a flaw in how the
Network Security Services (NSS) ASN.1 decoder handles zero length items. Effects
of this issue depend on the field. One known symptom is an unexploitable crash
in handling OCSP responses. NSS also mishandles zero-length basic constraints,
assuming default values for some types that should be rejected as malformed.
These issues have been addressed in NSS 3.13.4, which is now being used by
Mozilla.

Mozilla security researcher moz_bug_r_a4 reports that
by using an appropriately wrapped object it was possible to bypass the fix
for 
MFSA 2007-19. Prior to Firefox 3.6 this gives an attacker the ability
to perform cross-site scripting attacks against arbitrary sites as in the
original MFSA 2007-19 attack. Due to unrelated changes in the browser engine
used by Firefox 3.6, attacks in that version are limited to capturing keystroke
events from a cross-origin frame or window rather than full DOM access.
Those events might be sufficient to illicitly obtain passwords
or other sensitive information entered into web forms.
Thunderbird does not allow JavaScript to run in mail
messages, but users who open web content (such as RSS feeds, or other
content through add-ons) could be at risk.

Marius Schilder of Google Security reported that
when a XMLHttpRequest is made to a same-origin resource
which 302 redirects to a resource in a different domain, the response
from the cross-domain resource is readable by the site issuing the
XHR.  Cookies marked HttpOnly were not readable, but
other potentially sensitive data could be revealed in the XHR response
including URL parameters and content in the response body.Thunderbird shares the browser engine with Firefox and
could be vulnerable if JavaScript were to be enabled in mail. This is
not the default setting and we strongly discourage users from running
JavaScript in mail.

Matt Haggard reported that
the statusText property of an XMLHttpRequest
object is readable by the requester even when the request is made
across origins.  This status information reveals the presence of a web
server and could be used to gather information about servers on
internal private networks.This issue was also independently reported to Mozilla
by Nicholas Berthaume

Mozilla security researcher moz_bug_r_a4 reported that
the problem described in MFSA 2011-43 and fixed in
Firefox 7 also affected Firefox 3.6: a malicious page could potentially
exploit a Firefox user who had installed an add-on that used loadSubscript
in vulnerable ways.

Mozilla security researcher moz_bug_r_a4 reported
a series of vulnerabilities in which objects that normally receive
a XPCCrossOriginWrapper are constructed without the
wrapper.  This can lead to cases where JavaScript from one website may
unsafely access properties of such an object which had been set by a
different website.  A malicious website could use this vulnerability
to launch a XSS attack and run arbitrary JavaScript within the context
of another site.

Security researcher Mariusz Mlynski reported that when a
page opens a new tab, a subsequent window can then be opened that can be
navigated to about:newtab, a chrome privileged page. Once
about:newtab is loaded, the special context can potentially be used
to escalate privilege, allowing for arbitrary code execution on the local system
in a maliciously crafted attack.

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series critically rated of use-after-free, out of bounds read, and buffer overflow issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting three additional user-after-free and out of bounds read flaws introduced during Firefox development that were fixed before general release. 
In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner, some of which may
    allow execution of arbitrary code or local privilege escalation.

Mozilla developers identified and fixed several stability bugs in
the browser engine used in Firefox and other Mozilla-based
products. Some of these crashes showed evidence of memory corruption
under certain circumstances and we presume that with enough effort at
least some of these could be exploited to run arbitrary code.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team discovered a series of use-after-free, buffer overflow, and
out of bounds read issues using the Address Sanitizer tool in shipped software.
These issues are potentially exploitable, allowing for remote code execution.
We would also like to thank Abhishek for reporting two additional use-after-free
flaws introduced during Firefox 16 development and fixed before general release. 
In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Mozilla developers identified and fixed several memory safety bugs
in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption
under certain circumstances, and we presume that with enough effort at
least some of these could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the Thunderbird
and SeaMonkey products because scripting is disabled, but are potentially a risk
in browser or browser-like contexts in those products.