Julien Cristau

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 93 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code with enough effort. The vulnerability can be exploited by a remote attacker using a specially crafted website, allowing them to execute arbitrary code. **Recommendations** For versions prior to 93, update to version 93 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 93 Thunderbird versions prior to 91.3 Firefox ESR versions prior to 91.3 **Description** A use-after-free issue could have occurred when an HTTP2 session object was released on a different thread, leading to memory corruption and a potentially exploitable crash. The issue is related to the use of memory after it has been freed, which may allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 93, update to version 93 or later to resolve the issue. For Thunderbird versions prior to 91.3, update to version 91.3 or later to resolve the issue. For Firefox ESR versions prior to 91.3, update to version 91.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 67 **Description** The issue is related to memory safety bugs, including evidence of memory corruption, which could potentially be exploited to run arbitrary code. It is also described as a buffer overflow vulnerability in memory, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** pyro versions prior to 3.15 **Description** The issue arises from unsafe handling of pid files in temporary directory locations, allowing an attacker to potentially overwrite arbitrary files via symlinks when the pid file is opened as root. **Recommendations** For versions prior to 3.15, consider restricting access to the temporary directory locations where pid files are handled to minimize the risk of exploitation. As a temporary workaround, avoid opening the pid file as root until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 57 Firefox ESR versions prior to 52.5 Thunderbird versions prior to 52.5 **Description** The issue is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. This is due to memory safety bugs that have been reported, some of which show evidence of memory corruption. It is presumed that with sufficient effort, these bugs could be exploited to run arbitrary code. **Recommendations** For Firefox versions prior to 57, update to version 57 or later. For Firefox ESR versions prior to 52.5, update to version 52.5 or later. For Thunderbird versions prior to 52.5, update to version 52.5 or later.

**Name of the Vulnerable Software and Affected Versions** GNOME gnome-keyring versions 3.4.0 through 3.4.1 **Description** The issue is related to the caching of passphrases in GNOME gnome-keyring. When the gpg-cache-method is set to "idle" or "timeout", the software does not properly limit the amount of time a passphrase is cached. This could allow attackers to have an unspecified impact, although the exact attack vectors are not specified. **Recommendations** For versions 3.4.0 through 3.4.1, consider changing the gpg-cache-method setting to a more secure option to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IRCD-Hybrid (aka Hybrid2 IRC Services) versions 1.9.2 through 1.9.4 **Description** The issue allows remote attackers to cause a denial of service, resulting in a daemon crash. This can be achieved by sending a private message to the MemoServ service with the content ":help t". **Recommendations** For versions 1.9.2 through 1.9.4, consider restricting access to the MemoServ service until a fix is available. As a temporary workaround, avoid processing private messages with the ":help t" content to prevent daemon crashes.