Lcamtuf

**Name of the Vulnerable Software and Affected Versions** libjpeg-turbo versions 1.2.1 through 1.3.0 **Description** The issue is related to the get dht function in jdmarker.c, which does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers. This allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image. The vulnerability can be exploited remotely and may lead to a violation of confidentiality of protected information. **Recommendations** For libjpeg-turbo versions 1.2.1 through 1.3.0, update to a version later than 1.3.0 to resolve the issue. At the moment, there is no information about other specific fixes for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebKit (affected versions not specified) **Description** The issue allows remote attackers to send selected keystrokes to a form field in a hidden frame, instead of the intended form field in a visible frame, via certain calls to the `focus()` method. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 3.0.195.32 **Description** The issue allows remote attackers to force the download of certain dangerous files via a "Content-Disposition: attachment" designation. This can be demonstrated by various file types, including .mht and .mhtml files, which are automatically executed by Internet Explorer 6, .svg files executed by Safari, and other file types such as .xml, .htt, .xsl, .xslt, and certain image files that are forbidden by the victim's site policy. **Recommendations** For versions prior to 3.0.195.32, update to version 3.0.195.32 or later to resolve the issue. As a temporary workaround, consider restricting the download of potentially dangerous file types to minimize the risk of exploitation. Avoid using the `Content-Disposition: attachment` designation for files that could be automatically executed by other browsers, such as .mht, .mhtml, and .svg files, until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 2.0.0.12 Thunderbird versions prior to 2.0.0.12 **Description** The issue is related to the management of a delay timer used in confirmation dialogs. This might allow remote attackers to trick users into confirming an unsafe action, such as remote file execution, by using a timer to change the window focus, also known as the "dialog refocus bug" or "ffclick2". **Recommendations** For Mozilla Firefox versions prior to 2.0.0.12, update to version 2.0.0.12 or later to resolve the issue. For Thunderbird versions prior to 2.0.0.12, update to version 2.0.0.12 or later to resolve the issue.