Jerry Decime

An input validation issue was addressed with improved input validation.

A downgrade issue existed with HTTP authentication credentials saved in Keychain. This issue was addressed by storing the authentication types with the credentials.

A validation issue existed in the parsing of 407 responses, which was addressed through improved response validation.

The issue concerns proxy authentication, where HTTP proxies incorrectly reported receiving credentials securely. This was addressed through improved warnings.

The issue involves the `iBooks` component and allows man-in-the-middle attackers to spoof a password prompt.

The issue involves the `App Store` component and allows man-in-the-middle attackers to spoof password prompts.

The issue involves the WebKit component and allows remote attackers to spoof user-interface information about whether the entire content is derived from a valid TLS session via a crafted web site that sends a 401 Unauthorized redirect.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 58 Description: The issue is related to an authentication error in Mozilla Firefox when handling HTTP requests. This can lead to user confusion about the origin of an authentication request, potentially causing users to send private credentials to a third-party site. The problem arises when an HTTP authentication prompt is triggered by a background network request and is displayed over the currently loaded page, making it difficult for users to identify the real domain making the request. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider being cautious when encountering HTTP authentication prompts, especially if they appear over a foreground page, and verify the domain making the request to avoid sending credentials to unauthorized sites.

The issue involves the `CFNetwork Proxies` component, allowing man-in-the-middle attackers to spoof a proxy password authentication requirement and obtain sensitive information. It is related to errors in security settings, which can be exploited by a remote attacker to gain confidential information.

The issue concerns the D-Link DIR-685 router, which fails to maintain an encrypted wireless network when handling a large amount of network traffic under certain WPA and WPA2 configurations. This allows remote attackers to intercept sensitive information or bypass authentication using a Wi-Fi device.