Daniel Veditz

A mitigation bypass exists in the DOM Security component of Firefox. This issue could allow a bypass of security mitigations.

The issue is related to insufficient input validation when handling cookies, which could allow a remote attacker to execute arbitrary code. An attacker with temporary script access to a site could set a cookie containing invalid characters using `document.cookie`, potentially leading to unknown errors.

The issue is related to cursor spoofing attacks against users with a zoomed native cursor. It may allow a remote attacker to conduct spoofing attacks. The vulnerability is associated with errors in cryptographic transformations.

The issue affects Firefox on Windows operating systems, where it accepts any registered Program ID as an external protocol handler, offering to launch local applications when given a matching URL. This should only occur if the program has registered itself as a "URL Handler" in the Windows registry. The issue is specific to Windows operating systems, with other operating systems being unaffected.

The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Firefox ESR versions prior to 60.3 Thunderbird versions prior to 60.3 Description: The issue is related to an integer overflow, which may allow a remote attacker to execute arbitrary code. It has been reported that memory safety bugs are present, showing evidence of memory corruption, and it is presumed that these could be exploited with enough effort. Recommendations: For Firefox ESR versions prior to 60.3, update to version 60.3 or later. For Thunderbird versions prior to 60.3, update to version 60.3 or later.

The issue allows for users to be socially engineered into executing an XSS attack on themselves. This occurs when a "javascript:" URL is drag and dropped by a user into the address bar, and the URL will be processed and executed.

The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect.

The issue allows remote attackers to bypass intended sandbox restrictions via a crafted web site, due to improper consideration of the sandbox attribute of an IFRAME element during processing of a contained OBJECT element.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code. This is related to the `TraceRecorder::snapshot` function in `js/src/jstracer.cpp` and other unspecified vectors.

The issue concerns the jar: URI implementation, which fails to follow the Content-Disposition header of the inner URI. This allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly other attacks via an uploaded .jar file with a "Content-Disposition: attachment" designation.

The issue allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via vectors related to a reachable assertion or an integer overflow.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 3.x before 3.0.1 Description: The issue allows remote attackers to inject arbitrary web script into a chrome document via unspecified vectors. This can be demonstrated by injection into a XUL error page, which can potentially be leveraged to execute arbitrary code. Recommendations: For Mozilla Firefox versions 3.x before 3.0.1, update to version 3.0.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 2.0.0.5 and 3.0alpha Description: The issue allows remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a mailto, nntp, news, snews, or telnet URI. Recommendations: For Mozilla Firefox version 2.0.0.5, update to a version that contains a fix for this issue. For Mozilla Firefox version 3.0alpha, update to a version that contains a fix for this issue.

The issue is related to multiple unspecified vulnerabilities in the browser engine that can cause a denial of service (crash) due to memory corruption when processing unspecified vectors.

The issue is related to a heap-based buffer overflow that can be triggered by a VCard attachment containing a malformed base64 field. This field causes an integer underflow, leading to more data being copied than expected, which can result in a denial of service (crash).

The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via Javascript that leads to memory corruption. This includes problems with `nsListControlFrame::FireMenuItemActiveEvent`, buffer overflows in the string class in out-of-memory conditions, table row and column groups, anonymous box selectors outside of UA stylesheets, stale references to removed nodes, and running the `crypto.generateCRMFRequest` callback on deleted context.

The issue allows remote attackers to steal potentially sensitive information via an input control that monitors the values generated by the autocomplete capability.

The issue involves multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including libxul0d-dbg, libxul-dev, libsmjs1, libmozjs0d-dbg, libmozjs0d, libxul0d, libnss3-0d-dbg, libsmjs-dev, libnss3-0d, and libxul-common. These vulnerabilities can be exploited remotely, potentially leading to a disruption of confidentiality, integrity, and availability of protected information. Additionally, an integer overflow in the xpcom/io/nsEscape.cpp file in the browser engine of Mozilla Firefox can cause a denial of service (crash) via unknown vectors.