Xiaoyin Liu

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 80 Thunderbird versions prior to 78.2 Thunderbird versions prior to 68.12 Firefox ESR versions prior to 68.12 Firefox ESR versions prior to 78.2 **Description** The issue is related to the Mozilla Maintenance Service, which can execute updater.exe with system privileges if Firefox is installed in a user-writable directory. Although the service checks for a valid Mozilla signature, it does not prevent the version from being rolled back to a previous one, potentially allowing the exploitation of older bugs and arbitrary code execution with system privileges. This issue only affects Windows operating systems. **Recommendations** For Firefox versions prior to 80, update to version 80 or later to resolve the issue. For Thunderbird versions prior to 78.2, update to version 78.2 or later to resolve the issue. For Thunderbird versions prior to 68.12, update to version 68.12 or later to resolve the issue. For Firefox ESR versions prior to 68.12, update to version 68.12 or later to resolve the issue. For Firefox ESR versions prior to 78.2, update to version 78.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 69 **Description** The issue is related to the Content Security Policy (CSP) directives in Firefox, where specifying a wildcard ('*') for the host causes any port or path restrictions to be ignored, leading to improper application of CSP directives to content. Additionally, there is an issue with insufficient data authentication, which could allow a remote attacker to compromise data integrity. **Recommendations** For versions prior to 69, update to version 69 or later to resolve the issue. As a temporary workaround, consider avoiding the use of wildcards in CSP directives for the host until a patch is available. Restrict access to sensitive data to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 **Description** The issue is related to the Upgrade-Insecure-Requests (UIR) specification and Content Security Policy (CSP) in Firefox. When UIR is enabled through CSP, Firefox should upgrade navigation to a same-origin URL to HTTPS. However, in some cases, Firefox incorrectly navigates to an HTTP URL instead of performing the security upgrade, potentially allowing man-in-the-middle attacks on linked resources. This could allow a remote attacker to access and compromise confidential data. **Recommendations** For versions prior to 66, update to version 66 or later to resolve the issue. As a temporary workaround, consider disabling the UIR feature through CSP until a patch is available. Restrict access to sensitive data and resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 62.0.3202.62 Opera versions prior to 62.0.3202.62 **Description** The issue is related to insufficient data validation in V8, which allowed an attacker who can write to the Windows Registry to potentially exploit heap corruption via a crafted Windows Registry entry. This is related to PlatformIntegration. **Recommendations** For Google Chrome versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later. For Opera versions prior to 62.0.3202.62, update to version 62.0.3202.62 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 61.0.3163.79 for Mac, Windows, and Linux Google Chrome version prior to 61.0.3163.81 for Android **Description** The issue allows a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page, causing the browser to transmit cleartext even when the user enters an https URL. This is due to a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate, differing only in the initial "www." substring. **Recommendations** For Google Chrome versions prior to 61.0.3163.79 on Mac, Windows, and Linux, update to version 61.0.3163.79 or later. For Google Chrome version prior to 61.0.3163.81 on Android, update to version 61.0.3163.81 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 55 **Description** The issue affects Windows systems, where non-null-terminated strings copied into the crash reporter for specific registry keys can lead to the exposure of private data from the local system. This is due to the copying of stack memory data until a null is found. The attack is limited to Windows operating systems, with other operating systems not being affected. **Recommendations** For versions prior to 55, update to version 55 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 50 **Description** A security issue exists where Content Security Policy combined with HTTP to HTTPS redirection can be exploited by a malicious server to determine if a known site is in a user's browser history. **Recommendations** For versions prior to 50, update to version 50 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 52.0.2743.82 Opera (affected versions not specified) **Description** The issue is related to the CSPSource::schemeMatches function in the Content Security Policy (CSP) implementation in Blink. This function does not apply http policies to https URLs and does not apply ws policies to wss URLs, making it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report. **Recommendations** For Google Chrome versions prior to 52.0.2743.82, update to version 52.0.2743.82 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.