Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | * | 30.0 (including) |
| Thunderbird | Mozilla | * | 24.7 (including) |
| Thunderbird | Mozilla | 24.0 (including) | 24.0 (including) |
| Thunderbird | Mozilla | 24.0.1 (including) | 24.0.1 (including) |
| Thunderbird | Mozilla | 24.1 (including) | 24.1 (including) |
| Thunderbird | Mozilla | 24.1.1 (including) | 24.1.1 (including) |
| Thunderbird | Mozilla | 24.2 (including) | 24.2 (including) |
| Thunderbird | Mozilla | 24.3 (including) | 24.3 (including) |
| Thunderbird | Mozilla | 24.4 (including) | 24.4 (including) |
| Thunderbird | Mozilla | 24.5 (including) | 24.5 (including) |
| Thunderbird | Mozilla | 24.6 (including) | 24.6 (including) |
| Firefox | Ubuntu | devel | * |
| Firefox | Ubuntu | lucid | * |
| Firefox | Ubuntu | precise | * |
| Firefox | Ubuntu | trusty | * |
| Firefox | Ubuntu | upstream | * |
| Thunderbird | Ubuntu | devel | * |
| Thunderbird | Ubuntu | lucid | * |
| Thunderbird | Ubuntu | precise | * |
| Thunderbird | Ubuntu | trusty | * |
| Thunderbird | Ubuntu | upstream | * |