Paul Theriault

**Nome do software vulnerável e versões afetadas** Versões do Firefox anteriores à 78 **Descrição** O problema está relacionado à construção de um prompt de permissão para o WebRTC, no qual um URI não confiável proveniente do processo de conteúdo poderia contornar o prompt se fosse o URI de uma origem à qual a permissão já tivesse sido concedida anteriormente. Isso poderia permitir que um invasor remoto contornasse as restrições de segurança existentes. **Recomendações** Para versões do Firefox anteriores à 78, atualize para a versão 78 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso à funcionalidade WebRTC até que um patch esteja disponível.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 70 **Description** The issue is related to a lack of validation in the parent process of Firefox, which could allow an attacker to grant attacker-controlled permissions instead of the 'Click to Play' permission when a user accepts a permission request. This could potentially impact the integrity of data. **Recommendations** For versions prior to 70, update to version 70 or later to resolve the issue. As a temporary workaround, consider disabling the 'Click to Play' feature until a patch is available. Restrict access to sensitive data and permissions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 **Description** The issue is related to insufficient bounds checking of data during inter-process communication, which might allow a compromised content process to read memory from the parent process under certain conditions. This could potentially enable a remote attacker to access confidential data. **Recommendations** For versions prior to 66, update to version 66 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 64 Description: The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. Recommendations: For versions prior to 64, update to version 64 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and minimizing browser usage until the update is applied.

Name of the Vulnerable Software and Affected Versions: Mozilla Firefox versions prior to 58 Description: The issue is related to the Activity Stream page in Mozilla Firefox, where a lack of protection for internal data can be exploited. This could allow a remote attacker to gain unauthorized access to protected information using a 'file:' URL. The vulnerability involves the creation of screenshot images from meta tags of websites, which can attempt to load local files through 'file:' URLs, potentially exposing local data if combined with another attack that bypasses sandbox protections. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider restricting access to local files when using the Activity Stream page until a patch is applied. Avoid using 'file:' URLs in the Activity Stream page to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 52.1 Firefox versions prior to 53 **Description** The issue allows for a sandbox escape and escalation of privilege when combined with another vulnerability that results in remote code execution inside the sandboxed process. This is due to the internal feed reader APIs crossing the sandbox barrier. **Recommendations** For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Firefox versions prior to 53, update to version 53 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox OS versions prior to 2.2 **Description** The issue is related to the lack of protection for system messages in Firefox OS, allowing attackers to obtain potentially sensitive information via a crafted app. This could enable a remote attacker to access protected information contained in system messages. **Recommendations** For Mozilla Firefox OS versions prior to 2.2, consider restricting access to system messages or disabling the ability to read these messages until a patch is available. As a temporary workaround, avoid using crafted apps that could exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.