Package Instance

Security researcher Alex Chapman reported that the Almost
Native Graphics Layer Engine (ANGLE) library used by Mozilla is vulnerable to an
integer overflow. This vulnerability is present because of insufficient bounds
checking in the drawLineLoop function, which can be driven by web
content to overflow allocated memory, leading to a potentially exploitable
crash.
In general this flaw cannot be exploited through email in the
Thunderbird product because scripting is disabled, but is potentially a risk in
browser or browser-like contexts.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Mozilla developer Vladimir Vukicevic reported that Firefox
for Android will optionally load a shared object (.so) library in order to
enable GL tracing. When this is occurs, it can be from a world writable
location, allowing for it to be replaced by malicious third party applications
before it is loaded by Firefox. This would allow for accessing of all Firefox
data or for malicious code to be run by Firefox. This flaw requires malicious
software to be loaded on the device and is not accessible by web content.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Security researcher Takeshi Terada reported a mechanism to violate same-origin policy for local files using file:// through the use of symbolic links. This problem only affects web pages loaded from the local filesystem. This could allow for cross-site scripting (XSS) and access to locally stored Firefox files containing passwords and cookies.
This problem is specific to Firefox for Android.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.

Multiple vulnerabilities have been found in Mozilla Firefox,
    Thunderbird, and SeaMonkey, some of which may allow a remote user to
    execute arbitrary code.