Oriol Brufau

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 121 **Description** A `<dialog>` element could have been manipulated to paint content outside of a sandboxed iframe, allowing untrusted content to display under the guise of trusted content. The vulnerability is related to errors in interpreting data and could be exploited by a remote attacker to bypass existing security restrictions. **Recommendations** For versions prior to 121, update to version 121 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `<dialog>` element in sandboxed iframes until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 84.0.4147.105 **Description** The issue is related to a use after free in the CSS component of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may enable the attacker to access confidential data, compromise data integrity, and cause a denial of service. **Recommendations** For versions prior to 84.0.4147.105, update to version 84.0.4147.105 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 58 Firefox ESR versions prior to 52.6 Thunderbird versions prior to 52.6 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. This is due to a buffer overflow in memory, allowing a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 58, update to version 58 or later. For Firefox ESR versions prior to 52.6, update to version 52.6 or later. For Thunderbird versions prior to 52.6, update to version 52.6 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 Firefox ESR versions prior to 52.5 Thunderbird versions prior to 52.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. This is due to memory safety bugs that have been reported, some of which show evidence of memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 57, update to version 57 or later. For Firefox ESR versions prior to 52.5, update to version 52.5 or later. For Thunderbird versions prior to 52.5, update to version 52.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 57 **Description** The issue is related to the security wrapper not denying access to some exposed properties using the deprecated " exposedProps " mechanism on proxy objects. These properties should be explicitly unavailable to proxy objects. This could allow a remote attacker to gain unauthorized access to protected information. **Recommendations** For versions prior to 57, update to version 57 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 56 **Description** The issue is related to the "instanceof" operator, which can bypass the Xray wrapper mechanism. This allows web content to provide its own result for the operator, potentially tricking the browser or extension into mishandling the element. The vulnerability may be exploited by a remote attacker to impact data integrity. **Recommendations** For versions prior to 56, update to a version 56 or later to resolve the issue. As a temporary workaround, consider restricting the use of the "instanceof" operator in web content to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 45.0 **Description** The issue is related to the FileReader class in Mozilla Firefox, which has insufficient access control. This can be exploited by a local attacker to gain privileges or cause a denial of service (memory corruption) by changing a file during a FileReader API read operation. **Recommendations** For versions prior to 45.0, update to version 45.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the FileReader API until a patch is available.