Alex Chapman

**Name of the Vulnerable Software and Affected Versions** GitHub Enterprise Server versions prior to 3.6 GitHub Enterprise Server version 3.5.3 GitHub Enterprise Server version 3.4.6 GitHub Enterprise Server version 3.3.11 GitHub Enterprise Server version 3.2.16 **Description** A deserialization of untrusted data issue was identified that could potentially lead to remote code execution on the SVNBridge. To exploit this, an attacker would need to gain access via a server-side request forgery (SSRF) that would let an attacker control the data being deserialized. This issue was reported via the GitHub Bug Bounty program. **Recommendations** For versions prior to 3.6, update to version 3.6 or later to resolve the issue. For version 3.5.3, no additional action is required as this version contains a fix. For version 3.4.6, no additional action is required as this version contains a fix. For version 3.3.11, no additional action is required as this version contains a fix. For version 3.2.16, no additional action is required as this version contains a fix. As a temporary workaround, consider restricting access to the SVNBridge to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Docker versions prior to 19.03.15 Docker versions prior to 20.10.3 Description: The issue involves the --userns-remap option, which allows privilege escalation to real root when the root user in the remapped namespace has access to the host filesystem. This can lead to writing files with extended privileges under "/var/lib/docker/<remapping>". Recommendations: For Docker versions prior to 19.03.15, update to version 19.03.15 or later to prevent privilege escalation from remapped user. For Docker versions prior to 20.10.3, update to version 20.10.3 or later to prevent privilege escalation from remapped user. As a temporary workaround, consider restricting access to the host filesystem for the root user in the remapped namespace to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 51 **Description** The issue concerns Proxy Auto-Config (PAC) files, which can specify a JavaScript function that is called for all URL requests, potentially exposing more information than would be sent to the proxy itself in the case of HTTPS. Normally, the Proxy Auto-Config file is presumed to be non-malicious, but if a user has enabled Web Proxy Auto Detect (WPAD), this file can be served remotely, introducing a potential risk. **Recommendations** For Firefox versions prior to 51, update to version 51 or later to resolve the issue. As a temporary workaround, consider disabling Web Proxy Auto Detect (WPAD) to minimize the risk of exploitation. Restrict access to remote Proxy Auto-Config files to prevent potential malicious activity.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 51 **Description** The issue concerns data sent in multipart channels, such as the multipart/x-mixed-replace MIME type, ignoring the referrer-policy response header. This could lead to potential information disclosure for sites relying on this header. **Recommendations** For versions prior to 51, update to version 51 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 4.4.4 Android versions 5.0.x prior to 5.0.2 Android versions 5.1.x prior to 5.1.1 Android versions 6.x before 2016-07-01 **Description** The issue is related to the net/PacProxySelector.java script in the Proxy Auto-Config (PAC) feature, which lacks proper URL information restriction by scheme, host, and port. This can be exploited by a remote attacker to gain access to credentials by operating a server with a PAC script. **Recommendations** For Android versions prior to 4.4.4, update to version 4.4.4 or later. For Android versions 5.0.x prior to 5.0.2, update to version 5.0.2 or later. For Android versions 5.1.x prior to 5.1.1, update to version 5.1.1 or later. For Android versions 6.x before 2016-07-01, update to a version released after 2016-07-01.

**Name of the Vulnerable Software and Affected Versions** Captive Network Assistant in Apple OS X versions prior to 10.11.5 **Description** The issue exists due to insufficient input validation in the Captive Network Assistant component of Mac OS X. This allows a remote attacker to execute arbitrary code. The exploitation is possible through unspecified vectors, requiring user assistance. **Recommendations** For versions prior to 10.11.5, update to version 10.11.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of custom URL schemes in the Captive Network Assistant until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 9.3.2 Apple OS X versions prior to 10.11.5 Apple tvOS versions prior to 9.2.1 **Description** The issue is related to the mishandling of URLs in http and https requests by the CFNetwork Proxies subsystem. This allows remote attackers to obtain sensitive information via unspecified vectors. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited. **Recommendations** For Apple iOS versions prior to 9.3.2, update to version 9.3.2 or later. For Apple OS X versions prior to 10.11.5, update to version 10.11.5 or later. For Apple tvOS versions prior to 9.2.1, update to version 9.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 24.0 SeaMonkey versions prior to 2.21 **Description** The issue is related to an integer overflow in the `drawLineLoop` function within the libGLESv2 library of the Almost Native Graphics Layer Engine (ANGLE). This allows remote attackers to execute arbitrary code through a manipulated website. **Recommendations** For Mozilla Firefox versions prior to 24.0, update to version 24.0 or later. For SeaMonkey versions prior to 2.21, update to version 2.21 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 29.0.1547.57 **Description** The issue is related to multiple integer overflows in the Almost Native Graphics Layer Engine (ANGLE), specifically in the libGLESv2/renderer/Renderer9.cpp and libGLESv2/renderer/Renderer11.cpp files. This can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts via unknown vectors. **Recommendations** For Google Chrome versions prior to 29.0.1547.57, update to version 29.0.1547.57 or later to resolve the issue.