Linus Särud

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 101 **Descrição** O problema está relacionado ao tratamento incorreto de tags de comentário HTML pelo analisador HTML do navegador, o que pode permitir que um invasor remoto realize ataques de script entre sites (XSS). Isso pode ser explorado quando dados controlados pelo usuário são inseridos em comentários HTML em uma página da web, permitindo que o invasor escape dos comentários. **Recomendações** Para versões do Firefox anteriores à 101, atualize para a versão 101 ou posterior para resolver o problema. Como solução temporária, considere restringir o uso de dados controlados pelo usuário dentro de comentários HTML para minimizar o risco de exploração.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 60.8 Firefox versions prior to 68 Thunderbird versions prior to 60.8 **Description** The issue is related to an error in parsing page content, which can cause properly sanitized user input to be misinterpreted. This can lead to XSS hazards on websites under certain circumstances. The vulnerability may allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox ESR versions prior to 60.8, update to version 60.8 or later. For Firefox versions prior to 68, update to version 68 or later. For Thunderbird versions prior to 60.8, update to version 60.8 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.2 tvOS versions prior to 12.2 Safari versions prior to 12.1 iTunes for Windows versions prior to 12.9.4 iCloud for Windows versions prior to 7.11 WebKitGTK (affected versions not specified) WPE WebKit (affected versions not specified) **Description** A logic issue was addressed with improved validation, which may allow a malicious website to execute scripts in the context of another website. The issue is related to insecure privilege management in WebKitGTK and WPE WebKit modules, which can be exploited by a remote attacker using a specially crafted web page to execute arbitrary code. **Recommendations** For iOS versions prior to 12.2, update to iOS 12.2 or later. For tvOS versions prior to 12.2, update to tvOS 12.2 or later. For Safari versions prior to 12.1, update to Safari 12.1 or later. For iTunes for Windows versions prior to 12.9.4, update to iTunes 12.9.4 or later. For iCloud for Windows versions prior to 7.11, update to iCloud for Windows 7.11 or later. For WebKitGTK and WPE WebKit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 11.1 **Description** The issue involves the WebKit component and allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is a cross-site scripting (XSS) vulnerability. **Recommendations** For versions prior to 11.1, update to version 11.1 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious URLs to minimize the risk of exploitation.