The vulnerability of Thunderbird email client, Firefox and Firefox ESR browsers relates to improper error handling when processing an inaccessible PAC file. This allows a malicious actor to specify a URL for the PAC file. If the server on which the PAC file is located becomes unavailable, OCSP requests are blocked, resulting in incorrect error pages being displayed.

The vulnerability of the Thunderbird email client, as well as browsers Firefox and Firefox ESR, is related to improper error handling when processing an inaccessible PAC file. Exploiting this vulnerability allows a remote attacker to specify a PAC URL. If the server where the PAC file is located ...