Julien Cristau

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 93 **Descrição** O problema está relacionado a falhas de segurança de memória, incluindo indícios de corrupção de memória, que poderiam ser exploradas para executar código arbitrário com esforço suficiente. A vulnerabilidade pode ser explorada por um invasor remoto por meio de um site especialmente criado, permitindo-lhe executar código arbitrário. **Recomendações** Para versões anteriores à 93, atualize para a versão 93 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 93 Versões do Thunderbird anteriores à 91.3 Versões do Firefox ESR anteriores à 91.3 **Descrição** Um problema de uso após liberação (use-after-free) poderia ter ocorrido quando um objeto de sessão HTTP2 foi liberado em uma thread diferente, levando à corrupção de memória e a uma falha potencialmente explorável. O problema está relacionado ao uso da memória após ela ter sido liberada, o que pode permitir que um invasor remoto execute código arbitrário. **Recomendações** Para versões do Firefox anteriores à 93, atualize para a versão 93 ou posterior para resolver o problema. Para versões do Thunderbird anteriores à 91.3, atualize para a versão 91.3 ou posterior para resolver o problema. Para versões do Firefox ESR anteriores à 91.3, atualize para a versão 91.3 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pyro versions prior to 3.15 **Description** The issue arises from unsafe handling of pid files in temporary directory locations, allowing an attacker to potentially overwrite arbitrary files via symlinks when the pid file is opened as root. **Recommendations** For versions prior to 3.15, consider restricting access to the temporary directory locations where pid files are handled to minimize the risk of exploitation. As a temporary workaround, avoid opening the pid file as root until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 Firefox ESR versions prior to 52.5 Thunderbird versions prior to 52.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. This is due to memory safety bugs that have been reported, some of which show evidence of memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 57, update to version 57 or later. For Firefox ESR versions prior to 52.5, update to version 52.5 or later. For Thunderbird versions prior to 52.5, update to version 52.5 or later.

**Name of the Vulnerable Software and Affected Versions** GNOME gnome-keyring versions 3.4.0 through 3.4.1 **Description** The issue is related to the caching of passphrases in GNOME gnome-keyring. When the gpg-cache-method is set to "idle" or "timeout", the software does not properly limit the amount of time a passphrase is cached. This could allow attackers to have an unspecified impact, although the exact attack vectors are not specified. **Recommendations** For versions 3.4.0 through 3.4.1, consider changing the gpg-cache-method setting to a more secure option to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IRCD-Hybrid (aka Hybrid2 IRC Services) versions 1.9.2 through 1.9.4 **Description** The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This can be achieved by sending a private message to the MemoServ service with the content ":help t". **Recommendations** For versions 1.9.2 through 1.9.4, consider restricting access to the MemoServ service until a fix is available. As a temporary workaround, avoid processing private messages with the ":help t" content to prevent daemon crashes.