Xiaoyin Liu

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 80 Versões do Thunderbird anteriores à 78.2 Versões do Thunderbird anteriores à 68.12 Versões do Firefox ESR anteriores à 68.12 Versões do Firefox ESR anteriores à 78.2 **Descrição** O problema está relacionado ao Serviço de Manutenção da Mozilla, que pode executar o arquivo updater.exe com privilégios de sistema se o Firefox estiver instalado em um diretório no qual o usuário tem permissão de gravação. Embora o serviço verifique se há uma assinatura válida da Mozilla, ele não impede que a versão seja revertida para uma anterior, o que pode permitir a exploração de bugs antigos e a execução de código arbitrário com privilégios de sistema. Este problema afeta apenas sistemas operacionais Windows. **Recomendações** Para versões do Firefox anteriores à 80, atualize para a versão 80 ou posterior para resolver o problema. Para versões do Thunderbird anteriores à 78.2, atualize para a versão 78.2 ou posterior para resolver o problema. Para versões do Thunderbird anteriores à 68.12, atualize para a versão 68.12 ou posterior para resolver o problema. Para versões do Firefox ESR anteriores à 68.12, atualize para a versão 68.12 ou posterior para resolver o problema. Para versões do Firefox ESR anteriores à 78.2, atualize para a versão 78.2 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 69 **Description** The issue is related to the Content Security Policy (CSP) directives in Firefox, where specifying a wildcard ('*') for the host causes any port or path restrictions to be ignored, leading to improper application of CSP directives to content. Additionally, there is an issue with insufficient data authentication, which could allow a remote attacker to compromise data integrity. **Recommendations** For versions prior to 69, update to version 69 or later to resolve the issue. As a temporary workaround, consider avoiding the use of wildcards in CSP directives for the host until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 **Description** The issue is related to the Upgrade-Insecure-Requests (UIR) specification and Content Security Policy (CSP) in Firefox. When UIR is enabled through CSP, Firefox should upgrade navigation to a same-origin URL to HTTPS. However, in some cases, Firefox incorrectly navigates to an HTTP URL instead of performing the security upgrade, potentially allowing man-in-the-middle attacks on linked resources. This could allow a remote attacker to access and compromise confidential data. **Recommendations** For versions prior to 66, update to version 66 or later to resolve the issue. As a temporary workaround, consider disabling the UIR feature through CSP until a patch is available. Restrict access to sensitive data and resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 62.0.3202.62 Opera versions prior to 62.0.3202.62 **Description** The issue is related to insufficient data validation in V8, which allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry. This is related to PlatformIntegration. **Recommendations** For Google Chrome versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later. For Opera versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 61.0.3163.79 for Mac, Windows, and Linux Google Chrome version prior to 61.0.3163.81 for Android **Description** The issue allows a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page, causing the browser to transmit cleartext even when the user enters an https URL. This is due to a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate, differing only in the initial "www." substring. **Recommendations** For Google Chrome versions prior to 61.0.3163.79 on Mac, Windows, and Linux, update to version 61.0.3163.79 or later. For Google Chrome version prior to 61.0.3163.81 on Android, update to version 61.0.3163.81 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 55 **Description** The issue affects Windows systems, where non-null-terminated strings copied into the crash reporter for specific registry keys can lead to the exposure of private data from the local system. This is due to the copying of stack memory data until a null is found. The attack is limited to Windows operating systems, with other operating systems not being affected. **Recommendations** For versions prior to 55, update to version 55 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50 **Description** A security issue exists where Content Security Policy combined with HTTP to HTTPS redirection can be exploited by a malicious server to determine if a known site is in a user's browser history. **Recommendations** For versions prior to 50, update to version 50 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 52.0.2743.82 Opera (affected versions not specified) **Description** The issue is related to the CSPSource::schemeMatches function in the Content Security Policy (CSP) implementation in Blink. This function does not apply http policies to https URLs and does not apply ws policies to wss URLs, making it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. **Recommendations** For Google Chrome versions prior to 52.0.2743.82, update to version 52.0.2743.82 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.