Ameen Basha M K

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 151 Firefox ESR versions prior to 140.11 Thunderbird versions prior to 151 Thunderbird versions prior to 140.11 **Description** Incorrect boundary conditions in the Widget: Win32 component allow for a sandbox escape, which occurs when a process breaks out of its restricted environment to access the broader system. **Recommendations** Update to version 151 Update to version 140.11 Update to version 151 Update to version 140.11

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 147.0.7727.55 **Description** An integer overflow exists in the Media browser component of Google Chrome. Successful exploitation could allow a remote attacker to cause a denial-of-service through a specially crafted video file. The security severity is considered low. **Recommendations** Update Google Chrome to version 147.0.7727.55 or later.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description An integer overflow in Media in Google Chrome versions prior to 147.0.7727.55 could allow a remote attacker to potentially exploit heap corruption through a crafted video file. The Chromium security severity is rated as Low. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description An integer overflow issue exists in the Media component of Google Chrome. Successful exploitation of this issue could allow a remote attacker to cause a denial-of-service through a crafted video file. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 141 Description: A crafted URL utilizing a blob: URI could conceal the actual origin of the page, potentially leading to a spoofing attack. This issue specifically impacted Android operating systems. Recommendations: Update Firefox to version 141 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 138.0.7204.49 Description: Insufficient data validation in DevTools in Google Chrome on Windows allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. The issue has a security severity of Low. Recommendations: For versions prior to 138.0.7204.49, update to version 138.0.7204.49 or later to resolve the issue. As a temporary workaround, consider restricting access to DevTools until the update is applied. Avoid using crafted HTML pages that could exploit this issue until the update is installed.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: The issue arises when a user saves a response from the Network tab in Devtools using the Save As context menu option. In this scenario, the saved file may not have the `.download` file extension, potentially leading to the user inadvertently running a malicious executable. Recommendations: For versions prior to 140, update to version 140 or later to resolve the issue. As a temporary workaround, consider verifying the file extension of saved files from the Network tab in Devtools to avoid running malicious executables.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 139 Firefox ESR versions prior to 115.24 Firefox ESR versions prior to 128.11 **Description** The issue arises from insufficient escaping of the ampersand character in the "Copy as cURL" feature. This could allow an attacker to trick a user into executing a command, potentially leading to local code execution on the user's system. This bug only affects Firefox for Windows, with other versions of Firefox being unaffected. **Recommendations** For Firefox versions prior to 139, update to version 139 or later. For Firefox ESR versions prior to 115.24, update to version 115.24 or later. For Firefox ESR versions prior to 128.11, update to version 128.11 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 139 Firefox ESR versions prior to 115.24 Firefox ESR versions prior to 128.11 **Description** The issue is due to insufficient escaping of the newline character in the "Copy as cURL" feature. An attacker could trick a user into using this command, potentially leading to local code execution on the user's system. **Recommendations** For Firefox versions prior to 139, update to version 139 or later. For Firefox ESR versions prior to 115.24, update to version 115.24 or later. For Firefox ESR versions prior to 128.11, update to version 128.11 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 139 Firefox ESR versions prior to 128.11 **Description** A clickjacking issue could be exploited to trick a user into leaking saved payment card details to a malicious page. **Recommendations** For Firefox versions prior to 139, update to version 139 or later. For Firefox ESR versions prior to 128.11, update to version 128.11 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 128.10 Firefox ESR versions prior to 115.23 Thunderbird ESR versions prior to 128.10 **Description** The issue arises from insufficient escaping of special characters in the "copy as cURL" feature. This could allow an attacker to trick a user into executing a command, potentially leading to local code execution on the user's system. **Recommendations** For Firefox ESR versions prior to 128.10, update to version 128.10 or later. For Firefox ESR versions prior to 115.23, update to version 115.23 or later. For Thunderbird ESR versions prior to 128.10, update to version 128.10 or later.

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 131.0.6778.69 Microsoft Edge (affected versions not specified) Description: The issue is related to an inappropriate implementation in the FileSystem component, allowing a remote attacker to bypass filesystem restrictions via a crafted HTML page. This can be exploited by a remote attacker to bypass standard security checks. The severity of this issue is classified as low. Recommendations: For Google Chrome versions prior to 131.0.6778.69, update to version 131.0.6778.69 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 115 **Description** The issue is related to insufficient validation in the Drag and Drop API, which, when combined with social engineering, may allow an attacker to trick end-users into creating a shortcut to local system files. This could potentially be leveraged to execute arbitrary code. **Recommendations** For versions prior to 115, update to version 115 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Drag and Drop API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 112 Mozilla Firefox ESR versions prior to 102.10 Mozilla Thunderbird versions prior to 102.10 **Description** The issue is related to the incorrect handling of a newline in a filename, which could allow a remote attacker to bypass file extension security mechanisms. This mechanism replaces malicious file extensions, such as .lnk, with .download. The bypass could lead to the accidental execution of malicious code. This bug only affects Firefox and Thunderbird on Windows, with other versions of these applications being unaffected. **Recommendations** For Mozilla Firefox versions prior to 112, update to version 112 or later. For Mozilla Firefox ESR versions prior to 102.10, update to version 102.10 or later. For Mozilla Thunderbird versions prior to 102.10, update to version 102.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 112 Focus for Android versions prior to 112 Firefox ESR versions prior to 102.10 Firefox for Android versions prior to 112 Thunderbird versions prior to 102.10 **Description** The issue is related to the improper handling of file downloads with names ending in `.desktop`, which can be interpreted to run attacker-controlled commands. This bug only affects Firefox for Linux on certain distributions, with other operating systems being unaffected. The vulnerability can allow a remote attacker to bypass security restrictions and execute arbitrary commands. **Recommendations** For Firefox versions prior to 112, update to version 112 or later. For Focus for Android versions prior to 112, update to version 112 or later. For Firefox ESR versions prior to 102.10, update to version 102.10 or later. For Firefox for Android versions prior to 112, update to version 112 or later. For Thunderbird versions prior to 102.10, update to version 102.10 or later. As a temporary workaround, consider avoiding downloads of files with names ending in `.desktop` until a patch is available. Restrict access to potentially vulnerable systems to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 110 Thunderbird versions prior to 102.8 Firefox ESR versions prior to 102.8 **Description** The issue is related to incorrect external management of a file name or path, which could allow a remote attacker to impact the confidentiality and integrity of protected information. After downloading a Windows `.url` shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system, potentially leaking NTLM credentials to the resource. This bug only affects Firefox on Windows, with other operating systems being unaffected. **Recommendations** For Firefox versions prior to 110, update to version 110 or later. For Thunderbird versions prior to 102.8, update to version 102.8 or later. For Firefox ESR versions prior to 102.8, update to version 102.8 or later.

**Name of the Vulnerable Software and Affected Versions** jsuites versions prior to 5.0.1 **Description** The issue is related to Cross-site Scripting (XSS) due to improper user-input sanitization in the `Editor()` function. This allows for potential malicious script execution. **Recommendations** For versions prior to 5.0.1, update to version 5.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the `Editor()` function until a patch is available. Restrict access to user-input fields that utilize the `Editor()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 115 **Description** The issue is related to incorrect handling of symbolic links before accessing a file, potentially allowing a remote attacker to gain access to confidential data. Uploading files containing symlinks may trick a user into submitting sensitive data to a malicious website. **Recommendations** For versions prior to 115, update to version 115 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the feature that handles symlinks to minimize the risk of exploitation. Avoid using the file upload feature in the affected versions until the issue is resolved.