Antonio Sanso

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 64.0.3282.119 **Description** The issue allows a remote attacker to obtain referrer details via a crafted HTML page due to the XSS Auditor not ensuring the reporting URL was in the same origin as the page it was on. **Recommendations** For versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 55 **Description** An error in the elliptic curve point addition algorithm can yield an incorrect result, potentially allowing a man-in-the-middle attacker to interfere with a connection and cause the attacked party to compute an incorrect shared secret. **Recommendations** For versions prior to 55, update to version 55 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 50.0.2661.75 Opera versions prior to 50.0.2661.75 **Description** The issue arises from the incorrect reliance on GetOrigin method calls for origin comparisons in the Extensions subsystem. This allows remote attackers to bypass the Same Origin Policy, potentially obtaining sensitive information via a crafted extension. **Recommendations** For Google Chrome versions prior to 50.0.2661.75, update to version 50.0.2661.75 or later. For Opera versions prior to 50.0.2661.75, update to version 50.0.2661.75 or later. As a temporary workaround, consider restricting the use of extensions in Google Chrome and Opera until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Safari (affected versions not specified) **Description** The issue is related to insufficient input validation in the Safari browser's user interface on the iOS operating system. This could allow a remote attacker to exploit the issue and substitute a web page by spoofing its address (URI). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 6.2.8 Safari versions 7.x prior to 7.1.8 Safari versions 8.x prior to 8.0.8 iOS versions prior to 8.4.1 **Description** The issue is related to the WebKit component in Safari and iOS, which does not properly perform taint checking for CANVAS elements. This allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource. The vulnerability is associated with a lack of protection for internal data, which can be exploited by a remote attacker to bypass existing access restrictions and gain access to protected information. **Recommendations** For Safari versions prior to 6.2.8, update to version 6.2.8 or later. For Safari versions 7.x prior to 7.1.8, update to version 7.1.8 or later. For Safari versions 8.x prior to 8.0.8, update to version 8.0.8 or later. For iOS versions prior to 8.4.1, update to version 8.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions before 6.2.8 Apple Safari versions 7.x before 7.1.8 Apple Safari versions 8.x before 8.0.8 iOS versions before 8.4.1 **Description** The issue is related to the Content Security Policy implementation in WebKit, which does not properly restrict cookie transmission for report requests. This can allow a remote attacker to obtain sensitive information via vectors involving a cross-origin request or a private-browsing request. **Recommendations** For Apple Safari versions before 6.2.8, update to version 6.2.8 or later. For Apple Safari versions 7.x before 7.1.8, update to version 7.1.8 or later. For Apple Safari versions 8.x before 8.0.8, update to version 8.0.8 or later. For iOS versions before 8.4.1, update to version 8.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Sling org.apache.sling.servlets.post.bundle versions 2.2.0 through 2.3.0 **Description** The issue arises from the deepGetOrCreateNode function in AbstractCreateOperation.java, which fails to handle a NULL value returned when the session lacks permissions to the root node. This oversight allows remote attackers to trigger a denial of service, specifically an infinite loop, via unspecified vectors. **Recommendations** For versions 2.2.0 and 2.3.0, consider restricting access to the deepGetOrCreateNode function in AbstractCreateOperation.java until a patch is available to properly handle NULL values and prevent infinite loops.