1Lastbr3Ath

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to Big Sur 11.6.5 Security Update 2022-003 Catalina **Description** A cookie management issue was addressed with improved state management. Processing maliciously crafted web content may disclose sensitive user information. The issue is related to the WebKitGTK module and allows a remote attacker to access confidential data by exploiting the vulnerability. **Recommendations** For macOS versions prior to Big Sur 11.6.5, apply Security Update 2022-003 Catalina to fix the issue. For other affected versions, update to macOS Big Sur 11.6.5 or later to resolve the vulnerability. As a temporary workaround, consider restricting access to maliciously crafted web content until a patch is available.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 15.3 iPadOS versions prior to 15.3 watchOS versions prior to 8.4 tvOS versions prior to 15.3 Safari versions prior to 15.3 macOS Monterey versions prior to 12.2 **Description** A logic issue was addressed with improved state management. Processing maliciously crafted web content may prevent Content Security Policy from being enforced. The issue is related to incorrect restriction of visualizable user interface layers, which could allow a remote attacker to impact data integrity. **Recommendations** For iOS versions prior to 15.3, update to iOS 15.3 or later. For iPadOS versions prior to 15.3, update to iPadOS 15.3 or later. For watchOS versions prior to 8.4, update to watchOS 8.4 or later. For tvOS versions prior to 15.3, update to tvOS 15.3 or later. For Safari versions prior to 15.3, update to Safari 15.3 or later. For macOS Monterey versions prior to 12.2, update to macOS Monterey 12.2 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 96.0.4664.45 **Description** The issue is related to an inappropriate implementation in the referrer component of Google Chrome, which allowed a remote attacker to bypass navigation restrictions. This could be achieved via a specially crafted HTML page, potentially leading to the disclosure of protected information. **Recommendations** For Google Chrome versions prior to 96.0.4664.45, update to version 96.0.4664.45 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 14.6 iOS versions prior to 14.6 iPadOS versions prior to 14.6 Safari versions prior to 14.1.1 macOS Big Sur versions prior to 11.4 watchOS versions prior to 7.5 **Description** A logic issue was addressed with improved restrictions. This issue may allow a malicious application to leak sensitive user information. The problem is related to the disclosure of information and could be exploited by a remote attacker to access confidential data. **Recommendations** For tvOS versions prior to 14.6, update to version 14.6 to resolve the issue. For iOS versions prior to 14.6, update to version 14.6 to resolve the issue. For iPadOS versions prior to 14.6, update to version 14.6 to resolve the issue. For Safari versions prior to 14.1.1, update to version 14.1.1 to resolve the issue. For macOS Big Sur versions prior to 11.4, update to version 11.4 to resolve the issue. For watchOS versions prior to 7.5, update to version 7.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 63 **Description** The issue is related to the WebBrowserPersist component in Firefox, specifically with errors when executing the "Save Page As..." function. This can allow a remote attacker to gain unauthorized access to protected information. The internal WebBrowserPersist code does not use the correct origin context for a resource being saved, which manifests when sub-resources are loaded as part of the "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resources otherwise unreachable to the malicious page. Similarly, SameSite cookies are sent on cross-origin requests when the "Save Page As..." menu item is selected to save a page. **Recommendations** For versions prior to 63, update to version 63 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the "Save Page As..." functionality until a patch is available. Restrict access to sensitive information when using the "Save Page As..." feature to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** A security issue exists due to Microsoft Edge's improper handling of redirect requests, allowing it to bypass Cross-Origin Resource Sharing (CORS) redirect restrictions. This enables the browser to follow redirect requests that should be ignored, potentially forcing it to send restricted data to an attacker's chosen destination website. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.