André Bargull

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 **Description** A use-after-free issue exists in the JavaScript Engine’s JIT component. This can potentially allow for unexpected behavior. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 115.33 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 **Description** A use-after-free issue exists in the JavaScript Engine component. This can occur when memory is accessed after it has been freed, potentially leading to crashes or arbitrary code execution. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 115.33 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 **Description** An integer overflow exists in the JavaScript: Standard Library component. This issue may allow for unexpected behavior or potentially compromise system integrity. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 134.0.2 Firefox ESR versions prior to 140.4.0 Thunderbird versions prior to 138.0 Thunderbird versions prior to 137.0 **Description** The software is affected by memory safety flaws that could allow for arbitrary code execution. These flaws may lead to memory corruption, potentially enabling an attacker to exploit the system by tricking a user into opening a specially crafted website. No information is available regarding the number of potentially affected devices or real-world incidents. The issue involves a failure to properly validate buffer sizes during data copying operations. **Recommendations** Update Firefox to version 134.0.2 or later. Update Firefox ESR to version 140.4.0 or later. Update Thunderbird to version 138.0 or later. Update Thunderbird to version 137.0 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3 **Description** The issue is related to memory safety bugs, which have shown evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is also described as a buffer overflow in memory, which could allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 85 Firefox ESR versions prior to 78.7 Thunderbird versions prior to 78.7 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 85, update to version 85 or later. For Firefox ESR versions prior to 78.7, update to version 78.7 or later. For Thunderbird versions prior to 78.7, update to version 78.7 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 87.0.4280.88 **Description** The issue is related to an uninitialized use in the V8 JavaScript engine of Google Chrome, which can allow a remote attacker to obtain potentially sensitive information from process memory. This can be achieved via a crafted HTML page. **Recommendations** For versions prior to 87.0.4280.88, update to version 87.0.4280.88 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 **Description** A memory initialization issue was addressed with improved memory handling. Processing maliciously crafted web content may result in the disclosure of process memory. This issue is related to the disclosure of information in an erroneous data area, which can be exploited by a remote attacker to gain access to confidential data. **Recommendations** For macOS Big Sur versions prior to 11.3, update to macOS Big Sur 11.3 to resolve the issue. For iOS versions prior to 14.5, update to iOS 14.5 to resolve the issue. For iPadOS versions prior to 14.5, update to iPadOS 14.5 to resolve the issue. For watchOS versions prior to 7.4, update to watchOS 7.4 to resolve the issue. For tvOS versions prior to 14.5, update to tvOS 14.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions 68.7 through 68.7 Firefox versions 75 through 75 Thunderbird versions prior to 68.8.0 **Description** The issue is related to memory safety bugs, which can lead to memory corruption. With sufficient effort, these bugs could potentially be exploited to run arbitrary code. The vulnerability is also described as a buffer overflow in memory, which could allow a remote attacker to cause a denial of service. **Recommendations** For Firefox ESR version 68.7, update to version 68.8 or later. For Firefox version 75, update to version 76 or later. For Thunderbird versions prior to 68.8.0, update to version 68.8.0 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 68 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer data boundary operation vulnerability, where exploitation could allow a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 66, update to version 66 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 64 Description: The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. Recommendations: For versions prior to 64, update to version 64 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 Firefox ESR versions prior to 52.5 Thunderbird versions prior to 52.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. This is due to memory safety bugs that have been reported, some of which show evidence of memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 57, update to version 57 or later. For Firefox ESR versions prior to 52.5, update to version 52.5 or later. For Thunderbird versions prior to 52.5, update to version 52.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 54 Firefox ESR versions prior to 52.2 Thunderbird versions prior to 52.2 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. The vulnerability is associated with a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 54, update to version 54 or later. For Firefox ESR versions prior to 52.2, update to version 52.2 or later. For Thunderbird versions prior to 52.2, update to version 52.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 Safari versions prior to 10.1 **Description** The issue is related to insufficient access control in the WebKit component, which can be exploited by a remote attacker using a specially crafted website to spoof the address bar. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later to resolve the issue. For Safari versions prior to 10.1, update to version 10.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 Safari versions prior to 10.1 tvOS versions prior to 10.2 **Description** The issue involves the WebKit component and allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. It is related to insufficient access control in the WebKit component of Safari and iOS, which can be exploited by a remote attacker to bypass existing access restrictions or obtain confidential information using a specially crafted website. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later. For Safari versions prior to 10.1, update to version 10.1 or later. For tvOS versions prior to 10.2, update to version 10.2 or later. As a temporary workaround, consider restricting access to the WebKit component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 52 Firefox ESR versions prior to 45.8 Thunderbird versions prior to 52 Thunderbird versions prior to 45.8 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 52, update to version 52 or later. For Firefox ESR versions prior to 45.8, update to version 45.8 or later. For Thunderbird versions prior to 52, update to version 52 or later. For Thunderbird versions prior to 45.8, update to version 45.8 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 52 Thunderbird versions prior to 52 **Description** Memory safety bugs were reported, showing evidence of memory corruption. It is presumed that with enough effort, some of these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 52, update to version 52 or later. For Thunderbird versions prior to 52, update to version 52 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.2 macOS versions prior to 10.12.2 watchOS versions prior to 3.1.3 **Description** The issue involves the `ICU` component and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, resulting in memory corruption and application crash. **Recommendations** For iOS versions prior to 10.2, update to version 10.2 or later. For macOS versions prior to 10.12.2, update to version 10.12.2 or later. For watchOS versions prior to 3.1.3, update to version 3.1.3 or later.