Bob Clary

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 78 **Descrição** O problema está relacionado a falhas de segurança de memória, incluindo indícios de corrupção de memória, que poderiam ser exploradas para executar código arbitrário. Também é descrito como um problema de operação fora dos limites do buffer de dados, em que a exploração poderia permitir que um invasor remoto acessasse dados confidenciais, comprometesse sua integridade e causasse uma negação de serviço. **Recomendações** Para versões anteriores à 78, atualize para a versão 78 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso a dados confidenciais e implementar medidas de segurança adicionais para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 75 **Descrição** O problema está relacionado a falhas de segurança de memória identificadas no Firefox. Essas falhas apresentaram indícios de corrupção de memória, e presume-se que possam ser exploradas para executar código arbitrário com esforço suficiente. **Recomendações** Para versões anteriores à 75, atualize para a versão 75 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 73 Versões do Firefox ESR anteriores à 68.5 Versões do Thunderbird anteriores à 68.5 **Descrição** O problema está relacionado a falhas de segurança de memória que podem causar corrupção de memória. Presume-se que essas falhas possam ser exploradas para executar código arbitrário com esforço suficiente. Essas falhas são potencialmente arriscadas em navegadores ou contextos semelhantes a navegadores, mas não podem ser exploradas por e-mail no produto Thunderbird devido à desativação de scripts durante a leitura de e-mails. **Recomendações** Para versões do Firefox anteriores à 73, atualize para a versão 73 ou posterior. Para versões do Firefox ESR anteriores à 68.5, atualize para a versão 68.5 ou posterior. Para versões do Thunderbird anteriores à 68.5, atualize para a versão 68.5 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 72 Firefox ESR versions prior to 68.4 **Description** The issue is related to a memory safety bug that can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The bug is associated with a buffer copy error from memory without checking its size. Some of these bugs have shown evidence of memory corruption, and it is presumed that with sufficient effort, they could have been exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 72, update to version 72 or later to resolve the issue. For Firefox ESR versions prior to 68.4, update to version 68.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 70 Firefox ESR versions prior to 68.2 Thunderbird versions prior to 68.2 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Firefox versions prior to 70, update to version 70 or later. For Firefox ESR versions prior to 68.2, update to version 68.2 or later. For Thunderbird versions prior to 68.2, update to version 68.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 Firefox ESR versions prior to 60.6 Thunderbird versions prior to 60.6 **Description** The issue is related to memory safety bugs and buffer copying without checking the size of input data, which could potentially be exploited to run arbitrary code. This may lead to memory corruption. **Recommendations** For Firefox versions prior to 66, update to version 66 or later. For Firefox ESR versions prior to 60.6, update to version 60.6 or later. For Thunderbird versions prior to 60.6, update to version 60.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 59 Firefox ESR versions prior to 52.7 Thunderbird versions prior to 52.7 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to gain unauthorized access to information and compromise its integrity and availability. Memory safety bugs were reported, showing evidence of memory corruption, and it is presumed that these could be exploited to run arbitrary code with enough effort. **Recommendations** For Firefox versions prior to 59, update to version 59 or later to resolve the issue. For Firefox ESR versions prior to 52.7, update to version 52.7 or later to resolve the issue. For Thunderbird versions prior to 52.7, update to version 52.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 58 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. The vulnerability is also described as a buffer data boundary operation issue, allowing a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 Firefox ESR versions prior to 52.5 Thunderbird versions prior to 52.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. This is due to memory safety bugs that have been reported, some of which show evidence of memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 57, update to version 57 or later. For Firefox ESR versions prior to 52.5, update to version 52.5 or later. For Thunderbird versions prior to 52.5, update to version 52.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 54 ALT Linux (affected versions not specified) **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 54, update to version 54 or later to resolve the issue. At the moment, there is no information about a fix for ALT Linux.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 53 Firefox ESR versions prior to 45.9 Firefox ESR versions prior to 52.1 Thunderbird versions prior to 52.1 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 53, update to version 53 or later. For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Thunderbird versions prior to 52.1, update to version 52.1 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 57.0.2987.98 Opera versions prior to 57.0.2987.98 (note: exact version not specified, assuming similar to Chrome) **Description** A use after free issue in ANGLE allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. This could potentially be exploited by an attacker to access sensitive information. **Recommendations** For Google Chrome versions prior to 57.0.2987.98, update to version 57.0.2987.98 or later to resolve the issue. For Opera, since the exact fixed version is not specified, it is recommended to update to the latest version available, ensuring it is at or beyond the equivalent security patch level as Google Chrome 57.0.2987.98.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows XP versions SP2 through SP3 Microsoft Windows Server 2003 version SP2 **Description** A remote code execution issue exists in the Unicode Scripts Processor. This allows attackers to execute arbitrary code via a crafted OpenType font. An attacker who successfully exploits this issue could run arbitrary code as the current user. **Recommendations** For Microsoft Windows XP versions SP2 through SP3, update to a version that includes the fix for this issue. For Microsoft Windows Server 2003 version SP2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of crafted OpenType fonts until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 15.0 Firefox ESR versions prior to 10.0.7 Thunderbird versions prior to 15.0 Thunderbird ESR versions prior to 10.0.7 SeaMonkey versions prior to 2.12 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 15.0, update to version 15.0 or later. For Firefox ESR versions prior to 10.0.7, update to version 10.0.7 or later. For Thunderbird versions prior to 15.0, update to version 15.0 or later. For Thunderbird ESR versions prior to 10.0.7, update to version 10.0.7 or later. For SeaMonkey versions prior to 2.12, update to version 2.12 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.6.26 and 4.x through 9.0 Thunderbird versions prior to 3.1.18 and 5.0 through 9.0 SeaMonkey versions prior to 2.7 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 3.6.26, update to version 3.6.26 or later. For Mozilla Firefox versions 4.x through 9.0, update to a version later than 9.0. For Thunderbird versions prior to 3.1.18, update to version 3.1.18 or later. For Thunderbird versions 5.0 through 9.0, update to a version later than 9.0. For SeaMonkey versions prior to 2.7, update to version 2.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.18 Mozilla Firefox versions 3.6.x through 3.6.16 Thunderbird versions prior to 3.1.10 SeaMonkey versions prior to 2.0.14 **Description** The issue is related to multiple unspecified vulnerabilities in the browser engine, allowing remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.18, update to version 3.5.19 or later. For Mozilla Firefox versions 3.6.x through 3.6.16, update to version 3.6.17 or later. For Thunderbird versions prior to 3.1.10, update to version 3.1.10 or later. For SeaMonkey versions prior to 2.0.14, update to version 2.0.14 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.0.x through 3.0.17 Mozilla Firefox versions 3.5.x through 3.5.7 Thunderbird versions prior to 3.0.2 SeaMonkey versions prior to 2.0.3 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code. This is related to the `nsBlockFrame::StealFrame` function in `layout/generic/nsBlockFrame.cpp` and other unspecified vectors. **Recommendations** For Mozilla Firefox versions 3.0.x through 3.0.17, update to version 3.0.18 or later. For Mozilla Firefox versions 3.5.x through 3.5.7, update to version 3.5.8 or later. For Thunderbird versions prior to 3.0.2, update to version 3.0.2 or later. For SeaMonkey versions prior to 2.0.3, update to version 2.0.3 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.5 SeaMonkey versions prior to 2.0.1 **Description** The issue is related to memory safety problems, which could allow attackers to cause a denial of service, potentially leading to an application crash, or execute arbitrary code. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.5, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.1 **Description** The issue allows remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code. This is related to the `TraceRecorder::snapshot` function in `js/src/jstracer.cpp` and other unspecified vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.1, update to version 3.5.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.12 **Description** The issue is related to a "memory safety bug" in the JavaScript engine, specifically in the js watch set function. This bug can be exploited by remote attackers using a crafted .js file, potentially leading to a denial of service or possibly the execution of arbitrary code. **Recommendations** For versions prior to 3.0.12, update to version 3.0.12 or later to resolve the issue.