Frederik Braun

**Nome do Software Vulnerável e Versões Afetadas** Firefox versões anteriores a 152 Thunderbird versões anteriores a 152 **Descrição** Existe uma falha de bypass de mitigação no componente de segurança do DOM.

**Nome do software vulnerável e versões afetadas: Versões do Firefox ESR anteriores à 78.10 Versões do Thunderbird anteriores à 78.10 Versões do Firefox anteriores à 88 Descrição: A vulnerabilidade existe devido à validação insuficiente de entradas, permitindo que um invasor remoto contorne restrições de segurança. Isso pode ser explorado ao usar o cabeçalho Alt-Svc com portas escritas como um estouro de inteiro acima dos limites de um inteiro de 16 bits, potencialmente contornando restrições de bloqueio de portas. Recomendações: Para versões do Firefox ESR anteriores à 78.10, atualize para a versão 78.10 ou posterior. Para versões do Thunderbird anteriores à 78.10, atualize para a versão 78.10 ou posterior. Para versões do Firefox anteriores à 88, atualize para a versão 88 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do Thunderbird anteriores à 78 Versões do Firefox anteriores à 78.0.2 **Descrição** A vulnerabilidade permite o enquadramento de outros sites usando tags object ou embed, mesmo que esses sites proíbam o enquadramento com o cabeçalho X-Frame-Options. **Recomendações** Para versões do Thunderbird anteriores à 78, atualize para a versão 78 ou posterior. Para versões do Firefox anteriores à 78.0.2, atualize para a versão 78.0.2 ou posterior.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 76 **Descrição** Foram relatados bugs de segurança de memória no Firefox, que apresentavam indícios de corrupção de memória. Presume-se que, com esforço suficiente, alguns desses bugs poderiam ter sido explorados para executar código arbitrário. **Recomendações** Para versões anteriores à 76, atualize para a versão 76 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Nextcloud Server versão 16.0.1 **Descrição** Foi detectada uma vulnerabilidade de Cross-Site Scripting refletido na geração de arquivos SVG do software afetado. **Recomendações** Para o Nextcloud Server versão 16.0.1, atualize para uma versão que inclua uma correção para esta vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Djblets versions prior to 0.7.21 Beanbag Review Board versions prior to 1.7.15 **Description** The issue exists when parsing JSON requests, allowing an attacker to execute arbitrary Python code due to an eval() vulnerability. **Recommendations** For Djblets versions prior to 0.7.21, update to version 0.7.21 or later to resolve the issue. For Beanbag Review Board versions prior to 1.7.15, update to version 1.7.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 68 **Description** The issue is related to unnecessary application permissions that provide additional remote troubleshooting access to the retired site input.mozilla.org, now redirecting to another site. This could serve as a potential vector for malicious attacks. The vulnerability is associated with errors in Firefox's permission settings, which could allow a remote attacker to access and compromise confidential data. **Recommendations** For versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting access to remote troubleshooting features until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 67.0.4 Mozilla Firefox ESR versions prior to 60.7.2 Thunderbird versions prior to 60.7.2 **Description** The issue is caused by insufficient vetting of parameters passed with the `Prompt:Open` IPC message between child and parent processes. This can result in the non-sandboxed parent process opening web content chosen by a compromised child process, potentially allowing attackers to execute arbitrary code on the user's computer when combined with additional vulnerabilities. **Recommendations** For Mozilla Firefox versions prior to 67.0.4, update to version 67.0.4 or later. For Mozilla Firefox ESR versions prior to 60.7.2, update to version 60.7.2 or later. For Thunderbird versions prior to 60.7.2, update to version 60.7.2 or later. As a temporary workaround, consider restricting access to the `Prompt:Open` IPC message to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 55 **Description** The issue is related to the implementation of the WebRTC mechanism in Mozilla Firefox, which fails to protect the structure of web pages. This could potentially allow a remote attacker to conduct cross-site scripting (XSS) attacks. The vulnerability is difficult to exploit because the data is supplied by WebRTC usage and is not under third-party control. **Recommendations** For versions prior to 55, update to version 55 or later to resolve the issue. As a temporary workaround, consider restricting access to the "about:webrtc" page until a patch is available. Avoid using the `innerHTML` property in the affected page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 52.3 Firefox versions prior to 55 **Description** The Developer Tools feature has a XUL injection issue due to improper sanitization of web page source code. This could allow arbitrary code execution when opening a malicious page with the style editor tool. **Recommendations** For Firefox ESR versions prior to 52.3, update to version 52.3 or later. For Firefox versions prior to 55, update to version 55 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox OS versions prior to 2.5 **Description** The lockscreen feature does not properly restrict failed authentication attempts, making it easier for physically proximate attackers to obtain access by entering many passcode guesses. **Recommendations** For versions prior to 2.5, update to version 2.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache CouchDB versions prior to 1.0.4 Apache CouchDB versions 1.1.x prior to 1.1.2 Apache CouchDB versions 1.2.x prior to 1.2.1 **Description** A cross-site scripting (XSS) issue exists in the Futon UI of Apache CouchDB, allowing remote attackers to inject arbitrary web script or HTML via unspecified parameters to the browser-based test suite. **Recommendations** For versions prior to 1.0.4, update to version 1.0.4 or later. For versions 1.1.x prior to 1.1.2, update to version 1.1.2 or later. For versions 1.2.x prior to 1.2.1, update to version 1.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Review Board versions 1.6.x through 1.6.20 Review Board versions 1.7.x through 1.7.16 **Description** The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `Branch` field or the `caption` of an uploaded file. **Recommendations** For Review Board versions 1.6.x through 1.6.20, update to version 1.6.21 or later. For Review Board versions 1.7.x through 1.7.16, update to version 1.7.17 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 19.0 Firefox ESR versions 17.x prior to 17.0.3 Thunderbird versions prior to 17.0.3 Thunderbird ESR versions 17.x prior to 17.0.3 SeaMonkey versions prior to 2.16 **Description** The issue allows JavaScript workers to read the browser-profile directory name, which has unspecified impact and can be exploited through remote attack vectors. **Recommendations** For Mozilla Firefox versions prior to 19.0, update to version 19.0 or later. For Firefox ESR versions 17.x prior to 17.0.3, update to version 17.0.3 or later. For Thunderbird versions prior to 17.0.3, update to version 17.0.3 or later. For Thunderbird ESR versions 17.x prior to 17.0.3, update to version 17.0.3 or later. For SeaMonkey versions prior to 2.16, update to version 2.16 or later.