Arthur Gerkis

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code via a crafted HTML document in conjunction with a Cascading Style Sheets (CSS) token sequence. This is due to improper object access in memory, which could corrupt memory and allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take complete control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** The issue is related to incorrect access to objects in memory, which can cause a memory error and allow an attacker to execute arbitrary code in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer (affected versions not specified) **Description** The issue is related to a use-after-free error when working with the CDivElement object, allowing remote attackers to execute arbitrary code or cause a denial of service by accessing a specially crafted website. This could corrupt memory, enabling an attacker to execute code in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer (affected versions not specified) **Description** The issue is related to a use-after-free error when handling the CDomRange object, allowing an attacker to execute arbitrary code or cause a denial of service by visiting a specially crafted website. This could corrupt memory, enabling the attacker to execute code in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** The issue is related to a use-after-free condition in the CWindow destructor of Microsoft Internet Explorer, which can lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 8 through 10 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This occurs because Internet Explorer improperly accesses an object in memory, potentially corrupting it in a way that enables an attacker to execute arbitrary code in the context of the current user. **Recommendations** For Microsoft Internet Explorer versions 8 through 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** A remote code execution issue exists due to improper memory access by Internet Explorer, potentially allowing an attacker to execute arbitrary code in the context of the current user. This occurs when the browser improperly accesses an object in memory, which may result in memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer version 9 **Description** The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code via a crafted web site, triggering access to a deleted object. This vulnerability may corrupt memory, enabling an attacker to execute arbitrary code in the context of the current user. **Recommendations** For Microsoft Internet Explorer version 9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 9 through 10 **Description** The issue allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object. This occurs due to the way Internet Explorer accesses an object in memory that has been deleted, potentially corrupting memory and enabling an attacker to execute arbitrary code in the context of the current user. **Recommendations** For Microsoft Internet Explorer versions 9 and 10, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IcedTea-Web versions 1.1.x through 1.1.6 IcedTea-Web versions 1.2.x through 1.2.1 IcedTea-Web versions 1.3.x through 1.3.0 IcedTea-Web versions 1.4.x through 1.4.0 **Description** The issue is related to an off-by-one error in the invoke function, which can be triggered by a crafted webpage. This can lead to a heap-based buffer overflow, allowing remote attackers to obtain sensitive information, cause a denial of service, or possibly execute arbitrary code. **Recommendations** For versions 1.1.x, update to version 1.1.7 or later. For versions 1.2.x, update to version 1.2.2 or later. For versions 1.3.x, update to version 1.3.1 or later. For versions 1.4.x, update to version 1.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 15.0 Firefox ESR versions prior to 10.0.7 Thunderbird versions prior to 15.0 Thunderbird ESR versions prior to 10.0.7 SeaMonkey versions prior to 2.12 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption. This can be achieved via vectors involving the movement of a `requiredFeatures` attribute from one SVG document to another. **Recommendations** For Mozilla Firefox versions prior to 15.0, update to version 15.0 or later. For Firefox ESR versions prior to 10.0.7, update to version 10.0.7 or later. For Thunderbird versions prior to 15.0, update to version 15.0 or later. For Thunderbird ESR versions prior to 10.0.7, update to version 10.0.7 or later. For SeaMonkey versions prior to 2.12, update to version 2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 15.0 Firefox ESR versions prior to 10.0.7 Thunderbird versions prior to 15.0 Thunderbird ESR versions prior to 10.0.7 SeaMonkey versions prior to 2.12 **Description** The issue is caused by an integer overflow in the `nsSVGFEMorphologyElement::Filter` function, allowing remote attackers to execute arbitrary code via a crafted SVG filter. This triggers an incorrect sum calculation, leading to a heap-based buffer overflow. **Recommendations** For Mozilla Firefox versions prior to 15.0, update to version 15.0 or later. For Firefox ESR versions prior to 10.0.7, update to version 10.0.7 or later. For Thunderbird versions prior to 15.0, update to version 15.0 or later. For Thunderbird ESR versions prior to 10.0.7, update to version 10.0.7 or later. For SeaMonkey versions prior to 2.12, update to version 2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 21.0.1180.57 on Mac OS X and Linux Google Chrome versions prior to 21.0.1180.60 on Windows and Chrome Frame **Description** A use-after-free issue exists in the Cascading Style Sheets (CSS) DOM implementation, allowing remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted document. **Recommendations** For Google Chrome versions prior to 21.0.1180.57 on Mac OS X and Linux, update to version 21.0.1180.57 or later. For Google Chrome versions prior to 21.0.1180.60 on Windows and Chrome Frame, update to version 21.0.1180.60 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 13.0 Firefox ESR versions 10.x before 10.0.6 Thunderbird versions 5.0 through 13.0 Thunderbird ESR versions 10.x before 10.0.6 SeaMonkey versions prior to 2.11 **Description** A use-after-free issue in the `nsGlobalWindow::PageHidden` function might allow remote attackers to execute arbitrary code via vectors related to focused content. **Recommendations** For Mozilla Firefox versions 4.x through 13.0, update to a version after 13.0. For Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For Thunderbird versions 5.0 through 13.0, update to a version after 13.0. For Thunderbird ESR versions 10.x before 10.0.6, update to version 10.0.6 or later. For SeaMonkey versions prior to 2.11, update to version 2.11 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 6.0 Apple iTunes (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple Safari versions prior to 6.0, update to version 6.0 or later to resolve the issue. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 6.0 Apple iTunes (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple Safari versions prior to 6.0, update to version 6.0 or later to resolve the issue. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 12.0 Mozilla Firefox ESR versions 10.x before 10.0.5 Thunderbird versions 5.0 through 12.0 Thunderbird ESR versions 10.x before 10.0.5 SeaMonkey versions prior to 2.10 **Description** The issue is related to a use-after-free error in the `nsINode::ReplaceOrInsertBefore` function. This might allow remote attackers to execute arbitrary code via document changes involving replacement or insertion of a node. **Recommendations** For Mozilla Firefox versions 4.x through 12.0, update to a version after 12.0. For Mozilla Firefox ESR versions 10.x before 10.0.5, update to version 10.0.5 or later. For Thunderbird versions 5.0 through 12.0, update to a version after 12.0. For Thunderbird ESR versions 10.x before 10.0.5, update to version 10.0.5 or later. For SeaMonkey versions prior to 2.10, update to version 2.10 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 19.0.1084.46 Apple iTunes (affected versions not specified) **Description** A race condition exists, allowing remote attackers to cause a denial of service or possibly have other unspecified impacts via vectors related to worker processes. **Recommendations** For Google Chrome versions prior to 19.0.1084.46, update to version 19.0.1084.46 or later. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 18.0.1025.142 Apple iTunes (affected versions not specified) **Description** The issue is related to the improper handling of SVG text elements, which can be exploited by remote attackers to cause a denial of service through an out-of-bounds read via unspecified vectors. **Recommendations** For Google Chrome versions prior to 18.0.1025.142, update to version 18.0.1025.142 or later to resolve the issue. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 17.0.963.65 Apple iTunes (affected versions not specified) **Description** The issue is related to a use-after-free vulnerability, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This is achieved through vectors related to the handling of SVG values. **Recommendations** For Google Chrome versions prior to 17.0.963.65, update to version 17.0.963.65 or later to resolve the issue. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.