Package Instance

Mozilla developers and community identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.

Mozilla security researcher moz_bug_r_a4 reported that
through an interaction of frames and browser history it was possible to make the
browser believe attacker-supplied content came from the location of a previous
page in browser history. This allows for cross-site scripting (XSS) attacks by
loading scripts from a misrepresented malicious site through relative locations
and the potential access of stored credentials of a spoofed site.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

The CESG, the Information Security Arm of GCHQ, reported a dangling
pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI)
that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted
NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable
crash when triggered.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.