Package Instance

Mozilla developers and community identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based products.
Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.

Mozilla security researcher moz_bug_r_a4 reported that
through an interaction of frames and browser history it was possible to make the
browser believe attacker-supplied content came from the location of a previous
page in browser history. This allows for cross-site scripting (XSS) attacks by
loading scripts from a misrepresented malicious site through relative locations
and the potential access of stored credentials of a spoofed site.In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

The CESG, the Information Security Arm of GCHQ, reported a dangling
pointer dereference within the Netscape Plugin Application Programming Interface (NPAPI)
that could lead to the NPAPI subsystem crashing. This issue requires a maliciously crafted
NPAPI plugin in concert with scripted web content, resulting in a potentially exploitable
crash when triggered.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Mozilla developer Boris Zbarsky reported an inconsistency
with the different JavaScript engines in how JavaScript native getters on
window objects are handled by these engines. This inconsistency can
lead to different behaviors in JavaScript code, allowing for a potential
security issue with window handling by bypassing of some security checks. 
In general this flaw cannot be exploited through email in the
Thunderbird and Seamonkey products because scripting is disabled in mail, but is
potentially a risk in browser or browser-like contexts.

Using Address Sanitizer, security researcher Sascha Just reported a
buffer overflow in the libstagefright library due to issues with the handling of CENC
offsets and the sizes table. This results in a potentially exploitable crash triggerable
through web content.

Google security researcher Michal Zalewski reported an issue
where the browser displayed the content of a proxy's 407 response if a user
canceled the proxy's authentication prompt. In this circumstance, the addressbar
will continue to show the requested site's address, including HTTPS addresses
that appear to be secure. This spoofing of addresses can be used for phishing
attacks by fooling users into entering credentials, for example.
In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.

Security researchers Tyson Smith and Jesse
Schwartzentruber of the BlackBerry Security Automated Analysis Team
used the Address Sanitizer tool while fuzzing to discover a use-after-free
during host resolution in some circumstances. This leads to a potentially
exploitable crash.

Security researcher Abhishek Arya (Inferno) of the Google
Chrome Security Team reported an out of bounds write in the 
Netscape 
Portable Runtime (NSPR) leading to a potentially exploitable crash or code
execution. This issue is fixed in NSPR version 4.10.6.
This NSPR flaw was not exposed to web content in any shipped version of Firefox.

Mozilla developers and community identified identified and fixed several
memory safety bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption under certain
circumstances, and we presume that with enough effort at least some of these
could be exploited to run arbitrary code.In general these flaws cannot be exploited through email in the
Thunderbird product because scripting is disabled, but are potentially a risk in
browser or browser-like contexts.