Jed Davis

**Nome do Software Vulnerável e Versões Afetadas** Thunderbird versão 150 Firefox versão 150 **Descrição** Falhas de segurança de memória envolvendo corrupção de memória podem permitir que um invasor execute código arbitrário. **Recomendações** Atualize o Thunderbird para a versão 151. Atualize o Firefox para a versão 151.

**Nome do Software Vulnerável e Versões Afetadas** Versões do Firefox anteriores à 134.0.2 Versões do Firefox ESR anteriores à 140.4.0 Versões do Thunderbird anteriores à 138.0 Versões do Thunderbird anteriores à 137.0 **Descrição** O software é afetado por falhas de segurança de memória que podem permitir a execução arbitrária de código. Essas falhas podem levar à corrupção de memória, potencialmente permitindo que um atacante explore o sistema ao induzir um usuário a abrir um site especialmente criado. Não há informações disponíveis sobre o número de dispositivos potencialmente afetados ou incidentes reais. O problema envolve uma falha ao validar corretamente os tamanhos de buffer durante operações de cópia de dados. **Recomendações** Atualize o Firefox para a versão 134.0.2 ou posterior. Atualize o Firefox ESR para a versão 140.4.0 ou posterior. Atualize o Thunderbird para a versão 138.0 ou posterior. Atualize o Thunderbird para a versão 137.0 ou posterior.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 115.6 Thunderbird versions prior to 115.6 Firefox versions prior to 121 **Description** The issue is related to a buffer boundary violation. When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. This bug only affects Firefox on Unix-based operating systems, including Android, Linux, and MacOS, while Windows is unaffected. **Recommendations** For Firefox ESR versions prior to 115.6, update to version 115.6 or later. For Thunderbird versions prior to 115.6, update to version 115.6 or later. For Firefox versions prior to 121, update to version 121 or later. As a temporary workaround, consider restricting the use of symlinks in Firefox on Unix-based operating systems until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 119 Firefox ESR versions prior to 115.4 Thunderbird versions prior to 115.4.1 **Description** The issue is related to memory safety bugs that can lead to memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. The vulnerability is associated with a buffer overflow in memory, which can allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 119, update to version 119 or later. For Firefox ESR versions prior to 115.4, update to version 115.4 or later. For Thunderbird versions prior to 115.4.1, update to version 115.4.1 or later.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 96 **Descrição** Um processo de conteúdo comprometido poderia induzir processos com privilégios superiores a interagir com identificadores de recursos aos quais o processo sem privilégios não deveria ter acesso, ao aceitar e passar identificadores de recursos entre processos de maneira generalizada. Este problema afeta apenas o Firefox para Windows e macOS; outros sistemas operacionais não são afetados. **Recomendações** Para versões do Firefox anteriores à 96, atualize para a versão 96 ou posterior para resolver o problema. Como solução temporária, considere restringir as interações entre processos para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 60.5 Firefox ESR versions prior to 60.5 Firefox versions prior to 65 **Description** The issue is related to an Inter-process Communication (IPC) vulnerability. It affects the authentication mechanism between IPC endpoints and server parents during IPC process creation. The authentication is insufficient for channels created after the IPC process is started, which could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. **Recommendations** For Thunderbird versions prior to 60.5, update to version 60.5 or later. For Firefox ESR versions prior to 60.5, update to version 60.5 or later. For Firefox versions prior to 65, update to version 65 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 64 Firefox ESR versions prior to 60.4 Thunderbird versions prior to 60.4 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 64, update to version 64 or later. For Firefox ESR versions prior to 60.4, update to version 60.4 or later. For Thunderbird versions prior to 60.4, update to version 60.4 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 63 Firefox ESR versions prior to 60.3 Thunderbird versions prior to 60.3 **Description** The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. It is also described as a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 63, update to version 63 or later. For Firefox ESR versions prior to 60.3, update to version 60.3 or later. For Thunderbird versions prior to 60.3, update to version 60.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 62 Firefox ESR versions prior to 60.2 Thunderbird versions prior to 60.2.1 **Description** The issue is caused by memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. This affects various versions of Firefox, Firefox ESR, and Thunderbird. **Recommendations** For Firefox versions prior to 62, update to version 62 or later. For Firefox ESR versions prior to 60.2, update to version 60.2 or later. For Thunderbird versions prior to 60.2.1, update to version 60.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 52 Thunderbird versions prior to 52 **Description** The issue occurs on Linux when the seccomp-bpf filter is running and the Gecko Media Plugin sandbox is started, causing the sandbox to fail and leaving items with only the filter's protection, which is typically weaker than the sandbox. This issue is specific to Linux and does not affect other operating systems. **Recommendations** For Firefox versions prior to 52, update to version 52 or later to resolve the issue. For Thunderbird versions prior to 52, update to version 52 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 52 Thunderbird versions prior to 52 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 52, update to version 52 or later. For Thunderbird versions prior to 52, update to version 52 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Network Security Services (NSS) versions prior to 3.23 Mozilla Firefox versions prior to 47.0 **Description** The issue is related to errors in the code of the Network Security Services library and the Firefox browser. It may allow a remote attacker to cause a denial of service, such as memory corruption and application crash, or have other unspecified impacts. **Recommendations** For Mozilla Network Security Services (NSS) versions prior to 3.23, update to version 3.23 or later. For Mozilla Firefox versions prior to 47.0, update to version 47.0 or later.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 5.1.1 LMY49F Android versions prior to 6.0 2016-01-01 **Description** The issue is related to the `prctl vma anon name` function in the Android kernel, which lacks a procedure to check the availability of virtual memory areas for update. This can be exploited by a remote attacker using a specially crafted application to gain privileges or cause a denial of service, potentially leading to vma list corruption. **Recommendations** For Android versions prior to 5.1.1 LMY49F, update to version 5.1.1 LMY49F or later. For Android versions prior to 6.0 2016-01-01, update to version 6.0 2016-01-01 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 18.0.1025.168 Mozilla Firefox versions prior to 38.0 **Description** The Inter-process Communication (IPC) implementation does not properly validate messages, which has unspecified impact and attack vectors. **Recommendations** For Google Chrome versions prior to 18.0.1025.168, update to version 18.0.1025.168 or later. For Mozilla Firefox versions prior to 38.0, update to version 38.0 or later.