4B5F5F4B

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) ChakraCore (affected versions not specified) **Description** A security feature bypass issue exists in the Microsoft Chakra scripting engine, allowing Control Flow Guard (CFG) to be bypassed. This issue does not enable arbitrary code execution on its own but can be used in conjunction with another vulnerability, such as a remote code execution issue, to achieve arbitrary code execution on a target system. **Recommendations** For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ChakraCore, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 10.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For versions prior to 10.1, update to version 10.1 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted web sites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 Apple tvOS versions prior to 10.2.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 10.3.2, update to version 10.3.2 or later. For Safari versions prior to 10.1.1, update to version 10.1.1 or later. For tvOS versions prior to 10.2.1, update to version 10.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple iOS versions prior to 10.3.2, update to version 10.3.2 or later. For Apple Safari versions prior to 10.1.1, update to version 10.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions 8 through 8.1 Microsoft Windows Server versions 2012 Gold and R2 Microsoft Windows RT versions Gold and 8.1 **Description** A security feature bypass issue exists due to the Windows kernel's failure to properly validate a memory address. This allows an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass, enabling them to discover the cng.sys base address from a compromised process. To exploit this, an attacker must log on to an affected system. **Recommendations** For Microsoft Windows versions 8 through 8.1, update to a version that includes the security fix for this issue. For Microsoft Windows Server versions 2012 Gold and R2, apply the necessary patch or update to resolve the security feature bypass vulnerability. For Microsoft Windows RT versions Gold and 8.1, install the available security update that addresses this vulnerability.