Gary Kwong

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 150 Thunderbird versions prior to 150 **Description** An issue exists in the JavaScript Engine component. **Recommendations** Update Firefox to version 150. Update Thunderbird to version 150.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Thunderbird versions prior to 148 **Description** A JIT miscompilation issue exists in the JavaScript: WebAssembly component. JIT (Just-In-Time) compilation is a method used by browsers to improve execution speed by compiling code during runtime. This flaw can lead to a sequence of failures including use-after-free, type confusion, memory leak, and arbitrary read/write, potentially resulting in remote code execution. **Recommendations** Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Thunderbird versions prior to 148 **Description** A race condition exists in the JavaScript: GC component. A race condition occurs when multiple threads access and manipulate shared data concurrently, leading to unpredictable behavior. **Recommendations** Update Firefox to version 148 or later. Update Thunderbird to version 148 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 147 Firefox ESR versions prior to 140.7 **Description** A use-after-free issue exists in the JavaScript Engine component. This can potentially allow for unexpected behavior or code execution. **Recommendations** Update Firefox to version 147 or later. Update Firefox ESR to version 140.7 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Firefox ESR versions prior to 140.9 Thunderbird versions prior to 149 Thunderbird versions prior to 140.9 **Description** The JavaScript Engine component contains a JIT miscompilation issue. **Recommendations** Update Firefox to version 149 or later. Update Firefox ESR to version 140.9 or later. Update Thunderbird to version 149 or later. Update Thunderbird to version 140.9 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 149 Firefox ESR versions prior to 140.9 Thunderbird versions prior to 149 Thunderbird versions prior to 140.9 **Description** A use-after-free issue exists in the JavaScript Engine component. This condition occurs when memory is accessed after it has been freed, potentially leading to crashes or arbitrary code execution. **Recommendations** Update Firefox to version 149 or later. Update Firefox ESR to version 140.9 or later. Update Thunderbird to version 149 or later. Update Thunderbird to version 140.9 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 148 Firefox ESR versions prior to 115.33 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 **Description** A use-after-free issue exists in the JavaScript: GC component. This can lead to potential security consequences. **Recommendations** Update Firefox to version 148 or later. Update Firefox ESR to version 115.33 or later. Update Firefox ESR to version 140.8 or later. Update Thunderbird to version 148 or later. Update Thunderbird to version 140.8 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 26.1 watchOS versions prior to 26.1 iOS versions prior to 26.1 iPadOS versions prior to 26.1 visionOS versions prior to 26.1 **Description** A use-after-free issue exists due to improved memory management. Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue involves Array allocation sinking in DFG. **Recommendations** Update Apple Safari to version 26.1. Update watchOS to version 26.1. Update iOS to version 26.1. Update iPadOS to version 26.1. Update visionOS to version 26.1.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 26.1 iPadOS versions prior to 26.1 tvOS versions prior to 26.1 Safari versions prior to 26.1 visionOS versions prior to 26.1 **Description** A flaw exists due to improper state management. Processing specially designed web content can cause the application to crash unexpectedly. **Recommendations** Update iOS to version 26.1. Update iPadOS to version 26.1. Update tvOS to version 26.1. Update Safari to version 26.1. Update visionOS to version 26.1.

**Name of the Vulnerable Software and Affected Versions** Apple Safari (affected versions not specified) watchOS versions prior to 11.6 iOS versions prior to 18.6 iPadOS versions prior to 18.6 iPadOS version 17.7.9 tvOS versions prior to 18.6 macOS Sequoia versions prior to 15.6 macOS Sonoma versions prior to 14.7.7 visionOS versions prior to 2.6 macOS Ventura versions prior to 13.7.7 **Description** An out-of-bounds access issue exists due to insufficient bounds checking when processing maliciously crafted web content. This may lead to an unexpected Safari crash. **Recommendations** Update watchOS to version 11.6 or later. Update iOS to version 18.6 or later. Update iPadOS to version 18.6 or later. Update iPadOS to version 17.7.9. Update tvOS to version 18.6 or later. Update macOS Sequoia to version 15.6 or later. Update macOS Sonoma to version 14.7.7 or later. Update visionOS to version 2.6 or later. Update macOS Ventura to version 13.7.7 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 141 Firefox ESR versions prior to 115.26 Firefox ESR versions prior to 128.13 Firefox ESR versions prior to 140.1 Thunderbird versions prior to 141 Thunderbird versions prior to 128.13 Thunderbird versions prior to 140.1 **Description** On arm64 architecture, a WebAssembly (WASM) `br table` instruction with a large number of entries could result in the label being truncated due to its distance from the instruction. This truncation leads to an incorrect calculation of the branch address. **Recommendations** Update Firefox to version 141 or later. Update Firefox ESR to version 115.26 or later. Update Firefox ESR to version 128.13 or later. Update Firefox ESR to version 140.1 or later. Update Thunderbird to version 141 or later. Update Thunderbird to version 128.13 or later. Update Thunderbird to version 140.1 or later.

**Name of the Vulnerable Software and Affected Versions** WebKitGTK versions 2.48.0-0ubuntu0.24.10.1 and prior. **Description** The WebKitGTK web rendering engine contains an out-of-bounds write vulnerability (CVE-2025-24201). This vulnerability is due to the ability to toggle the WebGL context primitive restart from the WebContent process. A remote attacker could exploit this issue if a user views a malicious website, potentially leading to cross-site scripting attacks, denial of service attacks, and arbitrary code execution. **Recommendations** Update WebKitGTK to version 2.50.1 or later to address this vulnerability. Run `sudo pro fix USN-7395-1` to apply the fix.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 143 Firefox ESR versions prior to 140.3 Thunderbird versions prior to 143 Thunderbird versions prior to 140.3 **Description** The software contains a flaw. **Recommendations** Update Firefox to version 143 or later. Update Firefox ESR to version 140.3 or later. Update Thunderbird to version 143 or later. Update Thunderbird to version 140.3 or later.

**Name of the Vulnerable Software and Affected Versions** visionOS versions prior to 2.2 tvOS versions prior to 18.2 Safari versions prior to 18.2 watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 **Description** The issue is related to the processing of maliciously crafted web content, which may lead to memory corruption due to a buffer overflow in the Web Handler component. This can potentially allow a remote attacker to access confidential information. The problem was solved with improved memory handling. **Recommendations** For visionOS versions prior to 2.2, update to visionOS 2.2 or later. For tvOS versions prior to 18.2, update to tvOS 18.2 or later. For Safari versions prior to 18.2, update to Safari 18.2 or later. For watchOS versions prior to 11.2, update to watchOS 11.2 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 or later.

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.2 iPadOS versions prior to 17.7.3 and prior to 18.2 watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 Description: A type confusion issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to memory corruption. Recommendations: For Safari versions prior to 18.2, update to version 18.2 or later. For iPadOS versions prior to 17.7.3, update to version 17.7.3 or later. For iPadOS versions prior to 18.2, update to version 18.2 or later. For watchOS versions prior to 11.2, update to version 11.2 or later. For visionOS versions prior to 2.2, update to version 2.2 or later. For tvOS versions prior to 18.2, update to version 18.2 or later. For macOS Sequoia versions prior to 15.2, update to version 15.2 or later. For iOS versions prior to 18.2, update to version 18.2 or later.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 14.7.2 macOS versions prior to 15.2 iPadOS versions prior to 17.7.4 iPadOS versions prior to 18.2 iOS versions prior to 18.2 tvOS versions prior to 18.2 watchOS versions prior to 11.2 visionOS versions prior to 2.2 **Description** The issue is related to an out-of-bounds access problem in the ICU component of the operating systems, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is caused by the processing of maliciously crafted web content, leading to an unexpected process crash. **Recommendations** For macOS versions prior to 14.7.2, update to macOS Sonoma 14.7.2 or later. For macOS versions prior to 15.2, update to macOS Sequoia 15.2 or later. For iPadOS versions prior to 17.7.4, update to iPadOS 17.7.4 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For tvOS versions prior to 18.2, update to tvOS 18.2 or later. For watchOS versions prior to 11.2, update to watchOS 11.2 or later. For visionOS versions prior to 2.2, update to visionOS 2.2 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 131 Firefox ESR versions prior to 128.3 Thunderbird versions prior to 128.3 Thunderbird versions prior to 131 **Description** A potential memory corruption issue could be triggered during JIT compilation if an attacker can cause an out-of-memory (OOM) condition at a specific moment. This may allow a remote attacker to cause a denial of service. **Recommendations** For Firefox versions prior to 131, update to version 131 or later. For Firefox ESR versions prior to 128.3, update to version 128.3 or later. For Thunderbird versions prior to 128.3, update to version 128.3 or later. For Thunderbird versions prior to 131, update to version 131 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 17.6 tvOS versions prior to 17.6 visionOS versions prior to 1.3 watchOS versions prior to 10.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 macOS Sonoma versions prior to 14.6 **Description** The issue arises from processing maliciously crafted web content, which may lead to an unexpected process crash. **Recommendations** For Safari version prior to 17.6, update to version 17.6 or later. For tvOS version prior to 17.6, update to version 17.6 or later. For visionOS version prior to 1.3, update to version 1.3 or later. For watchOS version prior to 10.6, update to version 10.6 or later. For iOS version prior to 17.6, update to version 17.6 or later. For iPadOS version prior to 17.6, update to version 17.6 or later. For macOS Sonoma version prior to 14.6, update to version 14.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 125 **Description** A use-after-free issue could occur if a JavaScript realm was being initialized when a garbage collection started. This could potentially allow a remote attacker to execute arbitrary code. The vulnerability is related to the simultaneous loading of the global runtime environment and garbage collection. **Recommendations** For versions prior to 125, update to a version that contains a fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting the use of JavaScript realms until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 125 **Description** The issue is related to an out-of-memory condition during object initialization, which could result in an empty shape list. If the Just-In-Time (JIT) compiler subsequently traced the object, it would crash. This could potentially allow a remote attacker to cause a denial of service. **Recommendations** For versions prior to 125, update to a version that contains a fix for this issue to prevent potential crashes due to the out-of-memory condition during object initialization.