Debian: DSA-5645-1: firefox-esr security update

Manfred Paul discovered a flaw in the Mozilla Firefox web browser, allowing an attacker to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process.

attacker browser debian dsa esr event firefox flaw inject javascript mozilla mozilla firefox object paul privileged process security security update update web web browser