Igor Bukanov

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 81.0.4044.92 **Descrição** O problema está relacionado a uma vulnerabilidade do tipo “use after free” no gerenciamento de janelas, permitindo que um invasor remoto possa explorar uma corrupção de heap por meio de uma página HTML maliciosa. Isso pode levar ao acesso não autorizado a dados confidenciais, à violação da integridade dos dados e à negação de serviço. **Recomendações** Para versões do Google Chrome anteriores à 81.0.4044.92, atualize para a versão 81.0.4044.92 ou posterior para resolver o problema. Como solução temporária, considere evitar o uso de páginas HTML criadas especificamente para esse fim que possam desencadear a exploração da corrupção de heap até que um patch seja aplicado. Restrinja o acesso a dados confidenciais e monitore por quaisquer sinais de acesso não autorizado ou interrupção do serviço.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.17 Mozilla Firefox versions 3.6.x prior to 3.6.14 SeaMonkey versions prior to 2.0.12 **Description** A use-after-free issue in the JSON.stringify method might allow remote attackers to execute arbitrary code via unspecified vectors related to the `js HasOwnProperty` function and garbage collection. **Recommendations** For Mozilla Firefox versions prior to 3.5.17, update to version 3.5.17 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.14, update to version 3.6.14 or later. For SeaMonkey versions prior to 2.0.12, update to version 2.0.12 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.6.x prior to 3.6.13 Thunderbird versions 3.1.x prior to 3.1.7 **Description** The issue allows remote attackers to cause a denial of service, which includes memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.6.x prior to 3.6.13, update to version 3.6.13 or later. For Thunderbird versions 3.1.x prior to 3.1.7, update to version 3.1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.5.x through 3.5.5 SeaMonkey versions prior to 2.0.1 Thunderbird versions prior to 2.0.1 **Description** The issue is related to multiple unspecified vulnerabilities in the JavaScript engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions 3.5.x through 3.5.5, update to version 3.5.6 or later. For SeaMonkey versions prior to 2.0.1, update to version 2.0.1 or later. For Thunderbird versions prior to 2.0.1, update to version 2.0.1 or later.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 3.0.11 Thunderbird versions prior to 2.0.0.22 SeaMonkey versions prior to 1.1.17 Description: The issue allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via certain vectors. These vectors are related to `js LeaveSharpObject`, `ParseXMLSource`, and a certain assertion in `jsinterp.c`. Recommendations: For Mozilla Firefox versions prior to 3.0.11, update to version 3.0.11 or later. For Thunderbird versions prior to 2.0.0.22, update to version 2.0.0.22 or later. For SeaMonkey versions prior to 1.1.17, update to version 1.1.17 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 3.x through 3.0.8 Thunderbird versions 2.x through 2.0.0.21 SeaMonkey versions 1.x through 1.1.15 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and may also trigger memory corruption. This is achieved through vectors involving the `js FindPropertyHelper` function, which is related to the definitions of `Math` and `Date`, as well as the `js CheckRedeclaration` function. **Recommendations** For Mozilla Firefox versions 3.x through 3.0.8, update to version 3.0.9 or later. For Thunderbird versions 2.x through 2.0.0.21, update to version 2.0.0.22 or later. For SeaMonkey versions 1.x through 1.1.15, update to version 1.1.16 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.0.9 Thunderbird versions prior to 2.0.0.22 SeaMonkey versions prior to 1.1.16 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to application crashes, and may also trigger memory corruption. This is achieved through specific vectors involving `JSOP DEFVAR` and properties that lack the `JSPROP PERMANENT` attribute. **Recommendations** For Mozilla Firefox versions prior to 3.0.9, update to version 3.0.9 or later. For Thunderbird versions prior to 2.0.0.22, update to version 2.0.0.22 or later. For SeaMonkey versions prior to 1.1.16, update to version 1.1.16 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** The issue is related to the layout engine and can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.13 Thunderbird versions prior to 2.0.0.13 SeaMonkey versions prior to 1.1.9 **Description** The issue is related to the JavaScript engine and can be exploited by remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For Thunderbird versions prior to 2.0.0.13, update to version 2.0.0.13 or later. For SeaMonkey versions prior to 1.1.9, update to version 1.1.9 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 SeaMonkey versions prior to 1.1.8 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly trigger memory corruption via certain vectors, including large switch statements, specific uses of `watch` and `eval`, and certain uses of the `mousedown` event listener. **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later. For SeaMonkey versions prior to 1.1.8, update to version 1.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 1.5.x through 1.5.0.11 Mozilla Firefox versions 2.x through 2.0.0.3 Mozilla Thunderbird versions 1.5.x through 1.5.0.11 Mozilla Thunderbird versions 2.x through 2.0.0.3 SeaMonkey version 1.0.9 SeaMonkey version 1.1.2 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger memory corruption in the JavaScript engine. **Recommendations** For Mozilla Firefox versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Firefox versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For Mozilla Thunderbird versions 1.5.x through 1.5.0.11, update to version 1.5.0.12 or later. For Mozilla Thunderbird versions 2.x through 2.0.0.3, update to version 2.0.0.4 or later. For SeaMonkey version 1.0.9 and 1.1.2, update to a version that is not affected by this issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.10 Mozilla Firefox versions 2.x prior to 2.0.0.2 Thunderbird versions prior to 1.5.0.10 SeaMonkey versions prior to 1.0.8 **Description** The issue allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption in the JavaScript engine. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For Mozilla Firefox versions 2.x prior to 2.0.0.2, update to version 2.0.0.2 or later. For Thunderbird versions prior to 1.5.0.10, update to version 1.5.0.10 or later. For SeaMonkey versions prior to 1.0.8, update to version 1.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 Mozilla versions 1.7 and earlier **Description** The issue affects the JavaScript engine, allowing remote attackers to cause a denial of service, which may result in memory corruption and a crash, and possibly execute arbitrary code. The exact attack vectors are unknown. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later. For Mozilla versions 1.7 and earlier, update to a version later than 1.7.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 1.5.0.8 Thunderbird versions prior to 1.5.0.8 SeaMonkey versions prior to 1.0.6 Description: The issue is related to multiple unspecified vulnerabilities in the JavaScript engine. These vulnerabilities can be exploited by remote attackers to cause a denial of service, potentially leading to a crash, and may also allow the execution of arbitrary code. The exploitation is triggered by unspecified vectors that result in memory corruption. Recommendations: For Mozilla Firefox versions prior to 1.5.0.8, update to version 1.5.0.8 or later. For Thunderbird versions prior to 1.5.0.8, update to version 1.5.0.8 or later. For SeaMonkey versions prior to 1.0.6, update to version 1.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 1.5.0.5 Thunderbird versions prior to 1.5.0.5 SeaMonkey versions prior to 1.0.3 **Description** The issue is related to the Javascript engine, which might allow remote attackers to execute arbitrary code. This is due to vectors involving garbage collection that causes deletion of a temporary object that is still being used. **Recommendations** For Mozilla Firefox versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For Thunderbird versions prior to 1.5.0.5, update to version 1.5.0.5 or later. For SeaMonkey versions prior to 1.0.3, update to version 1.0.3 or later.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions 1.x before 1.5 Mozilla Thunderbird versions 1.x before 1.5 and 1.0.x before 1.0.8 Mozilla Suite versions prior to 1.7.13 SeaMonkey versions prior to 1.0 Description: The issue is related to the JavaScript engine's handling of temporary variables that are not properly garbage collected. This could potentially allow remote attackers to trigger operations on freed memory, leading to memory corruption. Recommendations: For Mozilla Firefox versions 1.x before 1.5, update to version 1.5 or later. For Mozilla Thunderbird versions 1.x before 1.5, update to version 1.5 or later. For Mozilla Thunderbird versions 1.0.x before 1.0.8, update to version 1.0.8 or later. For Mozilla Suite versions prior to 1.7.13, update to version 1.7.13 or later. For SeaMonkey versions prior to 1.0, update to version 1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla and Firefox versions prior to 1.5.1 **Description** The issue is related to the Javascript interpreter in Mozilla and Firefox, which does not properly dereference objects. This can be exploited by remote attackers to cause a denial of service, resulting in a crash, or to execute arbitrary code. The attack vectors are related to garbage collection, although the specifics are not detailed. **Recommendations** For versions prior to 1.5.1, update to version 1.5.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox version 1.5 **Description** The issue is related to the function allocation code in Firefox, specifically the js NewFunction in jsfun.c, which allows attackers to cause a denial of service and possibly execute arbitrary code. This is achieved through user-defined methods that trigger garbage collection in a way that operates on freed objects. **Recommendations** For Firefox version 1.5, consider disabling the js NewFunction until a patch is available. Restrict the use of user-defined methods that could trigger garbage collection to minimize the risk of exploitation.