Jonathan Kew

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 66 Firefox ESR versions prior to 60.6 Thunderbird versions prior to 60.6 **Description** The issue is related to memory safety bugs and buffer copying without checking the size of input data, which could potentially be exploited to run arbitrary code. This may lead to memory corruption. **Recommendations** For Firefox versions prior to 66, update to version 66 or later. For Firefox ESR versions prior to 60.6, update to version 60.6 or later. For Thunderbird versions prior to 60.6, update to version 60.6 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 64.0.3282.119 **Description** The issue concerns an incorrect security UI in the Omnibox, which is the URL bar in Google Chrome. This allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For Google Chrome versions prior to 64.0.3282.119, update to version 64.0.3282.119 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 **Description** The issue allows for domain spoofing attacks by exploiting the display of combined characters in the address bar. Specifically, the dotless version of the letter 'i' followed by an accent can be used to spoof the combined, single character version of the letter 'i' with the same accent in Unicode, such as acute or grave. This is possible because most font sets do not display these combined domain names as punycode. The vulnerability can be exploited by a remote attacker to conduct spoofing attacks. **Recommendations** For Firefox versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially spoofed domains until the update is applied.