Gavin Sharp

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 49.0 **Description** The issue allows remote attackers to bypass the Same Origin Policy via a crafted fragment identifier in the SRC attribute of an IFRAME element. This leads to insufficient restrictions on link-color information after a document is resized. **Recommendations** For versions prior to 49.0, update to version 49.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 10.0 Mozilla Firefox version 3.6.28 and earlier Firefox ESR versions 10.x through 10.0.2 Thunderbird versions 5.0 through 10.0 Thunderbird version 3.1.20 and earlier Thunderbird ESR versions 10.x through 10.0.2 SeaMonkey version 2.8 and earlier **Description** The issue allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a `javascript:` URL that is later interpreted in the `about:sessionrestore` context. This is possible because the software does not properly restrict setting the home page through the dragging of a URL to the home button. **Recommendations** For Mozilla Firefox versions 4.x through 10.0, update to a version later than 10.0 to resolve the issue. For Mozilla Firefox version 3.6.28 and earlier, update to a version later than 3.6.28 to resolve the issue. For Firefox ESR versions 10.x through 10.0.2, update to version 10.0.3 or later to resolve the issue. For Thunderbird versions 5.0 through 10.0, update to a version later than 10.0 to resolve the issue. For Thunderbird version 3.1.20 and earlier, update to a version later than 3.1.20 to resolve the issue. For Thunderbird ESR versions 10.x through 10.0.2, update to version 10.0.3 or later to resolve the issue. For SeaMonkey version 2.8 and earlier, update to a version later than 2.8 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote attackers to execute arbitrary Javascript in other domains. This is achieved by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution. Recommendations: For Firefox version 1.0.3, update to a newer version to mitigate the risk.

Name of the Vulnerable Software and Affected Versions: Firefox version 1.0.3 Description: The issue allows remote web sites on the browser's whitelist to execute arbitrary Javascript with chrome privileges. This can lead to arbitrary code execution on the system when combined with other vulnerabilities. The exploitation can be demonstrated using a javascript: URL as the package icon and a cross-site scripting (XSS) attack on a vulnerable whitelist site. Recommendations: For Firefox version 1.0.3, consider restricting access to the `install` function until a patch is available. As a temporary workaround, avoid using the `javascript:` URL scheme for package icons to minimize the risk of exploitation.