Mario Gomes

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 58 **Description** The issue allows for phishing attacks by spoofing the displayed URL in the address bar when a specially formatted URL is dragged from page content. This enables a malicious page to impersonate another site. **Recommendations** For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider avoiding dragging URLs from page content to the address bar until the update is applied. Restrict access to untrusted websites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Foxit Reader versions prior to 7.3.4 PhantomPDF versions prior to 7.3.4 **Description** The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code. This is achieved via an object with a revision number of -1 in a PDF document. **Recommendations** For Foxit Reader versions prior to 7.3.4, update to version 7.3.4 or later. For PhantomPDF versions prior to 7.3.4, update to version 7.3.4 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 4.2.15 Bugzilla versions 4.3.x through 4.4.10 Bugzilla versions 4.5.x through 5.0.1 **Description** The issue allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code, due to improper construction of CSV files in the Template.pm module. **Recommendations** For versions 2.x through 4.2.15, update to version 4.2.16 or later. For versions 4.3.x through 4.4.10, update to version 4.4.11 or later. For versions 4.5.x through 5.0.1, update to version 5.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 41.0 Mozilla Firefox ESR versions 38.x prior to 38.3 **Description** The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect. **Recommendations** For Mozilla Firefox versions prior to 41.0, update to version 41.0 or later to resolve the issue. For Mozilla Firefox ESR versions 38.x prior to 38.3, update to version 38.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript code in the browser until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** WebKit, as used in Apple iTunes versions prior to 10.7 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple iTunes versions prior to 10.7, update to version 10.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6 **Description** The issue allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms. This is achieved via a feed:javascript: URL, which is not properly handled in terms of its security context. **Recommendations** For Mozilla Firefox versions 4.x through 13.0, update to a version later than 13.0 to resolve the issue. For Mozilla Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 4.x through 13.0 Mozilla Firefox ESR versions 10.x before 10.0.6 **Description** The issue affects the drag-and-drop implementation, allowing remote attackers to spoof the address bar by canceling a page load. **Recommendations** For Mozilla Firefox versions 4.x through 13.0, update to a version after 13.0. For Mozilla Firefox ESR versions 10.x before 10.0.6, update to version 10.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 4.0.2 through 4.0.4 Bugzilla versions 4.1.1 through 4.2rc2 **Description** A cross-site request forgery issue affects the xmlrpc.cgi component in Bugzilla when mod perl is used. This allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API. **Recommendations** For Bugzilla versions 4.0.2 through 4.0.4, update to a version outside of this range to resolve the issue. For Bugzilla versions 4.1.1 through 4.2rc2, update to a version outside of this range to resolve the issue. As a temporary workaround, consider disabling the xmlrpc.cgi component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 3.5.x through 3.6.7 Bugzilla versions 3.7.x through 4.0.3 Bugzilla versions 4.1.x through 4.2rc1 **Description** A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API. **Recommendations** For Bugzilla versions 3.5.x through 3.6.7, update to version 3.6.8 or later. For Bugzilla versions 3.7.x through 4.0.3, update to version 4.0.4 or later. For Bugzilla versions 4.1.x through 4.2rc1, update to version 4.2rc2 or later.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 4.x before 4.2rc1 **Description** A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for uploading attachments. **Recommendations** For Bugzilla versions 2.x through 4.x before 4.2rc1, update to version 4.2rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions 2.x through 4.x before 4.2rc1 **Description** A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports. **Recommendations** For Bugzilla versions 2.x through 4.x before 4.2rc1, update to version 4.2rc1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 14.0.835.163 **Description** The issue is related to improper garbage collection during the processing of PDF documents, which can be exploited by remote attackers using a crafted document. This can lead to a denial of service or possibly have other unspecified impacts. **Recommendations** For versions prior to 14.0.835.163, update to version 14.0.835.163 or later to resolve the issue.