The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
| Software | From | Fixed in |
|---|---|---|
| mozilla / firefox | 19.0 | 19.0.x |
| mozilla / firefox | 19.0.2 | 19.0.2.x |
| mozilla / firefox | 20.0.1 | 20.0.1.x |
| mozilla / firefox | 19.0.1 | 19.0.1.x |
| mozilla / firefox | 20.0 | 20.0.x |
| mozilla / firefox | - | 21.0.x |
| mozilla / thunderbird | 17.0.3 | 17.0.3.x |
| mozilla / thunderbird | 17.0.1 | 17.0.1.x |
| mozilla / thunderbird | 17.0.4 | 17.0.4.x |
| mozilla / thunderbird | 17.0 | 17.0.x |
| mozilla / thunderbird | 17.0.2 | 17.0.2.x |
| mozilla / thunderbird | - | 17.0.6.x |
| mozilla / thunderbird | 17.0.5 | 17.0.5.x |
| mozilla / thunderbird_esr | 17.0.1 | 17.0.1.x |
| mozilla / thunderbird_esr | 17.0.2 | 17.0.2.x |
| mozilla / thunderbird_esr | 17.0.3 | 17.0.3.x |
| mozilla / thunderbird_esr | 17.0.5 | 17.0.5.x |
| mozilla / thunderbird_esr | 17.0.6 | 17.0.6.x |
| mozilla / thunderbird_esr | 17.0.4 | 17.0.4.x |
| mozilla / thunderbird_esr | 17.0 | 17.0.x |
| mozilla / firefox | 17.0 | 17.0.x |
| mozilla / firefox | 17.0.1 | 17.0.1.x |
| mozilla / firefox | 17.0.2 | 17.0.2.x |
| mozilla / firefox | 17.0.3 | 17.0.3.x |
| mozilla / firefox | 17.0.4 | 17.0.4.x |
| mozilla / firefox | 17.0.5 | 17.0.5.x |
| mozilla / firefox | 17.0.6 | 17.0.6.x |