Mihalis Haatainen

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 153 Thunderbird versions prior to 153 **Description** A denial-of-service issue exists within the Graphics: WebGPU component. WebGPU is a modern API that allows web applications to access the GPU for hardware-accelerated graphics and computation. **Recommendations** Update Firefox to version 153. Update Thunderbird to version 153.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 152 Firefox ESR versions prior to 140.12 Thunderbird versions prior to 152 Thunderbird versions prior to 140.12 **Description** A memory safety bug exists in the software, which could lead to unexpected behavior or crashes when handling memory operations. **Recommendations** Update Firefox to version 152. Update Firefox ESR to version 140.12. Update Thunderbird to version 152. Update Thunderbird to version 140.12.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 152 Firefox ESR versions prior to 140.12 Thunderbird versions prior to 152 Thunderbird versions prior to 140.12 **Description** A memory safety bug exists in the software, which could lead to unexpected behavior or crashes when handling memory operations. **Recommendations** Update Firefox to version 152. Update Firefox ESR to version 140.12. Update Thunderbird to version 152. Update Thunderbird to version 140.12.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 152 Firefox ESR versions prior to 140.12 Thunderbird versions prior to 152 Thunderbird versions prior to 140.12 **Description** Incorrect boundary conditions exist in the Graphics: CanvasWebGL component.

**Name of the Vulnerable Software and Affected Versions** Microsoft Defender for Endpoint for Mac (affected versions not specified) **Description** A time-of-check time-of-use (TOCTOU) race condition occurs in Microsoft Defender for Endpoint. This is a software bug where a system checks a condition (such as a security credential) and then uses the result of that check, but the condition changes between the check and the use. This flaw allows an authorized attacker to elevate privileges locally due to synchronization errors when using a shared resource. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 18.7.9 iOS versions prior to 26.5 iPadOS versions prior to 18.7.9 iPadOS versions prior to 26.5 macOS Sequoia versions prior to 15.7.7 macOS Sonoma versions prior to 14.8.7 macOS Tahoe versions prior to 26.5 tvOS versions prior to 26.5 visionOS versions prior to 26.5 watchOS versions prior to 26.5 **Description** A use-after-free race condition exists in the IOKit framework, specifically within the IOTimeSyncFamily kernel extension and the `IOTimeSyncClockManager` component. A use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after the memory it points to has been freed. This flaw may allow an app to cause unexpected system termination. **Recommendations** Update iOS to version 18.7.9 or 26.5 Update iPadOS to version 18.7.9 or 26.5 Update macOS Sequoia to version 15.7.7 Update macOS Sonoma to version 14.8.7 Update macOS Tahoe to version 26.5 Update tvOS to version 26.5 Update visionOS to version 26.5 Update watchOS to version 26.5

**Name of the Vulnerable Software and Affected Versions** Demisto version 4.5 build 40249 **Description** The issue exists due to inadequate protection of the web page structure, allowing for cross-site scripting (XSS) attacks. This can enable a remote attacker to execute arbitrary JavaScript or HTML using a specially crafted hyperlink. **Recommendations** For Demisto version 4.5 build 40249, update to a version that includes a fix for this issue to prevent cross-site scripting attacks. As a temporary workaround, consider restricting access to potentially vulnerable web pages or modules within Demisto until a patch is available.