Bo13Oy

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 98 **Description** The issue is related to a use-after-free error, which could lead to a potentially exploitable crash. This occurs when an individual thread outlives its manager during shutdown. The vulnerability may allow a remote attacker to execute arbitrary code. **Recommendations** For versions prior to 98, update to version 98 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 91.5 Firefox versions prior to 96 Thunderbird versions prior to 91.5 **Description** The issue is related to a use-after-free error due to a race condition when playing audio files and closing windows. This could lead to a potentially exploitable crash, allowing a remote attacker to create a specially crafted audio shell and execute arbitrary code in the system. The exploitation is tied to the construction of audio sinks and the concurrent closure of windows. **Recommendations** For Firefox ESR versions prior to 91.5, update to version 91.5 or later. For Firefox versions prior to 96, update to version 96 or later. For Thunderbird versions prior to 91.5, update to version 91.5 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 91.5 Firefox versions prior to 96 Thunderbird versions prior to 91.5 **Description** The issue is related to a use-after-free error, which could lead to a potentially exploitable crash. This occurs due to certain network request objects being freed too early when releasing a network request handle. The vulnerability is also associated with the function ChannelEventQueue::mOwner in the affected software, where memory is used after it has been freed. Exploitation of this issue could allow a remote attacker to cause a use-after-free error and potentially execute arbitrary code on the system. **Recommendations** For Firefox ESR versions prior to 91.5, update to version 91.5 or later. For Firefox versions prior to 96, update to version 96 or later. For Thunderbird versions prior to 91.5, update to version 91.5 or later.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 91.4.0 Firefox ESR versions prior to 91.4.0 Firefox versions prior to 95 **Description** The issue is related to an incorrect type conversion of sizes from 64bit to 32bit integers, which can lead to memory corruption and a potentially exploitable crash. This can be exploited by a remote attacker using a specially crafted web page, potentially allowing for arbitrary code execution through a heap-based buffer overflow on the client side. **Recommendations** For Thunderbird versions prior to 91.4.0, update to version 91.4.0 or later. For Firefox ESR versions prior to 91.4.0, update to version 91.4.0 or later. For Firefox versions prior to 95, update to version 95 or later.

**Name of the Vulnerable Software and Affected Versions** Microsoft Malware Protection Engine (MPE) (affected versions not specified) **Description** The issue is related to errors in code generation management within the Microsoft Malware Protection Engine (MPE). Exploitation of this issue may allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 91.8 Firefox ESR versions prior to 91.8 **Description** The issue is related to a use-after-free error that occurs after a VR Process is destroyed, potentially leading to a crash. This error can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with a memory release error when handling HTML content after the VR process is destroyed. An attacker can create a specially crafted web page, trick the victim into opening it, and cause a use-after-free error, allowing the execution of arbitrary code in the system. **Recommendations** For Thunderbird versions prior to 91.8, update to version 91.8 or later to resolve the issue. For Firefox ESR versions prior to 91.8, update to version 91.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 68.4 Firefox versions prior to 72 **Description** A type confusion vulnerability could occur due to a missing case handling object types, resulting in a crash. It is presumed that with enough effort, this issue could be exploited to run arbitrary code, potentially allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Firefox ESR versions prior to 68.4, update to version 68.4 or later. For Firefox versions prior to 72, update to version 72 or later.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer and Microsoft Edge (affected versions not specified) **Description** A remote code execution issue exists in the way the scripting engine handles objects in memory in Microsoft browsers. This could allow an attacker to corrupt memory and execute arbitrary code in the context of the current user. If the current user has administrative rights, a successful exploit could give the attacker control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier **Description** The issue is related to an exploitable use after free vulnerability in the PSDK's MediaPlayer class. This vulnerability could allow a remote attacker to execute arbitrary code. The vulnerability is associated with the use of memory after it has been freed, which can be exploited to achieve remote code execution. **Recommendations** For Adobe Flash Player versions 23.0.0.207 and earlier, update to a version later than 23.0.0.207 to resolve the issue. For Adobe Flash Player versions 11.2.202.644 and earlier, update to a version later than 11.2.202.644 to resolve the issue. As a temporary workaround, consider disabling the `PSDK's MediaPlayer` class until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier **Description** The issue is caused by an out-of-bounds operation in the memory buffer of the Worker class in the Flash Player platform. This can allow a remote attacker to execute arbitrary code or cause a denial of service due to memory corruption. **Recommendations** For Adobe Flash Player versions 23.0.0.207 and earlier, update to a version later than 23.0.0.207 to resolve the issue. For Adobe Flash Player versions 11.2.202.644 and earlier, update to a version later than 11.2.202.644 to resolve the issue. As a temporary workaround, consider disabling the Worker class functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.207 and earlier Adobe Flash Player versions 11.2.202.644 and earlier **Description** The issue is related to an integer overflow vulnerability in the BitmapData class of Adobe Flash Player. This vulnerability can be exploited to achieve arbitrary code execution. Successful exploitation could allow a remote attacker to execute arbitrary code. **Recommendations** For Adobe Flash Player versions 23.0.0.207 and earlier, update to a version later than 23.0.0.207 to resolve the issue. For Adobe Flash Player versions 11.2.202.644 and earlier, update to a version later than 11.2.202.644 to resolve the issue. As a temporary workaround, consider disabling the use of the BitmapData class until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.205 and earlier Adobe Flash Player versions 11.2.202.643 and earlier **Description** The issue is related to a use-after-free vulnerability that could lead to arbitrary code execution if successfully exploited. This vulnerability allows attackers to execute arbitrary code. **Recommendations** For Adobe Flash Player versions 23.0.0.205 and earlier, update to a version later than 23.0.0.205 to resolve the issue. For Adobe Flash Player versions 11.2.202.643 and earlier, update to a version later than 11.2.202.643 to resolve the issue. As a temporary workaround, consider disabling the use of Adobe Flash Player until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.205 and earlier Adobe Flash Player versions 11.2.202.643 and earlier **Description** The issue is related to a type confusion vulnerability that can be exploited, potentially leading to arbitrary code execution. **Recommendations** For Adobe Flash Player versions 23.0.0.205 and earlier, update to a version later than 23.0.0.205 to resolve the issue. For Adobe Flash Player versions 11.2.202.643 and earlier, update to a version later than 11.2.202.643 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions 23.0.0.205 and earlier Adobe Flash Player versions 11.2.202.643 and earlier **Description** The issue is related to a type confusion vulnerability that can be exploited, potentially leading to arbitrary code execution. **Recommendations** For Adobe Flash Player versions 23.0.0.205 and earlier, update to a version later than 23.0.0.205 to resolve the issue. For Adobe Flash Player versions 11.2.202.643 and earlier, update to a version later than 11.2.202.643 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Oracle Java SE versions 6u113, 7u99, and 8u77 **Description** The issue affects confidentiality, integrity, and availability via vectors related to 2D. It is reported that this issue may allow remote attackers to obtain sensitive information via crafted font data, which triggers an out-of-bounds read. The vulnerability is related to errors in the code and can be exploited by a remote attacker to influence the integrity, availability, and confidentiality of information. **Recommendations** For Oracle Java SE version 6u113, update to a version that includes the fix for this issue. For Oracle Java SE version 7u99, update to a version that includes the fix for this issue. For Oracle Java SE version 8u77, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the 2D component until a patch is available.