Peter Van Der Beken

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 91.5 Firefox versions prior to 96 Thunderbird versions prior to 91.5 **Description** The issue is related to bypassing an iframe sandbox in Firefox, Firefox ESR, and Thunderbird. It involves constructing specific XSLT markup to circumvent security restrictions when processing XSLT markup. This could allow a remote attacker to bypass the iframe sandbox and execute arbitrary JavaScript code in the context of an arbitrary window. **Recommendations** For Firefox ESR versions prior to 91.5, update to version 91.5 or later. For Firefox versions prior to 96, update to version 96 or later. For Thunderbird versions prior to 91.5, update to version 91.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 17.0 Thunderbird versions prior to 17.0 SeaMonkey versions prior to 2.14 **Description** The issue allows remote attackers to bypass intended chrome-only restrictions on reading DOM object properties via a crafted web site, due to the XrayWrapper implementation not considering the compartment during property filtering. **Recommendations** For Mozilla Firefox versions prior to 17.0, update to version 17.0 or later. For Thunderbird versions prior to 17.0, update to version 17.0 or later. For SeaMonkey versions prior to 2.14, update to version 2.14 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.12 Thunderbird versions prior to 3.0.12 **Description** The issue is related to the JavaScript engine and can cause a denial of service or possibly execute arbitrary code. It is related to vectors such as `nsDOMClassInfo.cpp`, `JS HashTableRawLookup`, `MirrorWrappedNativeParent`, and `js LockGCThingRT`. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information. **Recommendations** For Mozilla Firefox versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue. For Thunderbird versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue. As a temporary workaround, consider disabling JavaScript in the browser until a patch is available.