Andreas Pehrson

توجد ثغرة أمنية من نوع «الاستخدام بعد التحرير» (use-after-free) في مكون الصوت/الفيديو في WebRTC. وقد يؤدي ذلك إلى حدوث سلوك غير متوقع أو تعطل البرنامج.

The issue is related to memory safety bugs, which could potentially be exploited to run arbitrary code. These bugs showed evidence of memory corruption. The vulnerability can be exploited by a remote attacker using a specially crafted website, potentially leading to memory damage and arbitrary code execution in the target system.

The issue is related to memory safety bugs present in Firefox, which can lead to memory corruption. With sufficient effort, these bugs could be exploited to run arbitrary code. This allows a remote attacker to execute code in the system.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 86 Thunderbird versions prior to 78.8 Firefox ESR versions prior to 78.8 Description: A decoding error may occur when loading a cross-origin resource in an audio/video context, potentially revealing information about the resource. Recommendations: For Firefox versions prior to 86, update to version 86 or later. For Thunderbird versions prior to 78.8, update to version 78.8 or later. For Firefox ESR versions prior to 78.8, update to version 78.8 or later.

The issue is related to a lack of protection for service data. It may allow a remote attacker to gain unauthorized access to information. Additionally, there is a problem with WebRTC where malicious web content can use probing techniques on the `getUserMedia` API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification, potentially allowing for user fingerprinting.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 58 Description: The issue is related to a flaw in the source confirmation mechanism, potentially allowing a remote attacker to gain unauthorized access to protected information. An audio capture session can be started under an incorrect origin, leading to user confusion about which site is making the request to capture an audio stream. Users are still prompted to allow the request, but the prompt may display the wrong origin. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider restricting access to audio capture sessions to minimize the risk of exploitation. Avoid allowing audio capture requests from untrusted sites until the issue is resolved.