Jonathan Metzman

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 45.0 **Description** The issue is caused by an integer underflow in the Brotli algorithm implementation. This can be exploited by a remote attacker using specially crafted data compressed with the Brotli algorithm, potentially allowing the execution of arbitrary code or causing a denial of service. **Recommendations** For versions prior to 45.0, update to version 45.0 or later to resolve the issue. As a temporary workaround, consider disabling Brotli compression until a patch is available. Restrict access to compressed data to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 48.0.2564.109 Opera (affected versions not specified) Brotli (affected versions not specified) **Description** The issue is caused by an integer underflow in the `ProcessCommandsInternal` function in `dec/decode.c` in Brotli. This can be exploited by remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted data with brotli compression. **Recommendations** For Google Chrome versions prior to 48.0.2564.109, update to version 48.0.2564.109 or later. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the `ProcessCommandsInternal` function in Brotli until a patch is available. Restrict access to the `dec/decode.c` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 9.0.2 iOS versions prior to 9.2 **Description** The issue is related to the misparsing of content extensions in WebKit, which can allow remote attackers to obtain sensitive browsing-history information via a crafted web site. This is due to a lack of protection for service data. An attacker can exploit this issue to gain access to browsing history using a specially formed web site. **Recommendations** For Safari versions prior to 9.0.2, update to version 9.0.2 or later to resolve the issue. For iOS versions prior to 9.2, update to version 9.2 or later to resolve the issue.