Steven Michaud

**Name of the Vulnerable Software and Affected Versions** Firefox versões anteriores a 150 Firefox ESR versões anteriores a 140.10 Thunderbird versões anteriores a 150 Thunderbird versões anteriores a 140.10 **Description** Um problema de use-after-free existe no componente Widget: Cocoa. O use-after-free ocorre quando uma aplicação continua a usar um ponteiro após ele ter sido liberado, o que pode levar a falhas no sistema ou execução de código arbitrário. **Recommendations** Atualizar para a versão 150 Atualizar para a versão 140.10 Atualizar para a versão 150 Atualizar para a versão 140.10

**Nome do Software Vulnerável e Versões Afetadas** Versões do Firefox anteriores à 139.0.4 **Descrição** Determinadas operações de canvas poderiam ter levado à corrupção de memória. **Recomendações** Para versões anteriores à 139.0.4, atualize para a versão 139.0.4 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 34.0 Firefox ESR versions prior to 31.3 Thunderbird versions prior to 31.3 **Description** The issue allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information, due to the omission of a CoreGraphics disable-logging action needed by jemalloc-based applications. **Recommendations** For Mozilla Firefox versions prior to 34.0, update to version 34.0 or later. For Firefox ESR versions prior to 31.3, update to version 31.3 or later. For Thunderbird versions prior to 31.3, update to version 31.3 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Mac OS X versions prior to 10.7.2 **Description** The issue is related to a buffer overflow in the ATSFontDeactivate API within Apple Type Services (ATS) in Apple Mac OS X. This allows remote attackers to potentially execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors. **Recommendations** For versions prior to 10.7.2, update to version 10.7.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 3.5.16 Mozilla Firefox versions 3.6.x prior to 3.6.13 SeaMonkey versions prior to 2.0.11 **Description** The issue arises from improper handling of certain redirections involving data: URLs and Java LiveConnect scripts. This allows remote attackers to start processes, read arbitrary local files, and establish network connections. The attack vector involves a refresh value in the http-equiv attribute of a META element, causing the wrong security principal to be used. **Recommendations** For Mozilla Firefox versions prior to 3.5.16, update to version 3.5.16 or later. For Mozilla Firefox versions 3.6.x prior to 3.6.13, update to version 3.6.13 or later. For SeaMonkey versions prior to 2.0.11, update to version 2.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions 2.x prior to 2.0.0.1 Mozilla Firefox versions 1.5.x prior to 1.5.0.9 Thunderbird versions prior to 1.5.0.9 SeaMonkey versions prior to 1.0.7 **Description** A use-after-free issue in the LiveConnect bridge code allows remote attackers to cause a denial of service, resulting in a crash, via unknown vectors. **Recommendations** For Mozilla Firefox versions 2.x prior to 2.0.0.1, update to version 2.0.0.1 or later. For Mozilla Firefox versions 1.5.x prior to 1.5.0.9, update to version 1.5.0.9 or later. For Thunderbird versions prior to 1.5.0.9, update to version 1.5.0.9 or later. For SeaMonkey versions prior to 1.0.7, update to version 1.0.7 or later.