Lukas Bernhard

**Name of the Vulnerable Software and Affected Versions** Arm Ltd Bifrost GPU Userspace Driver versions r48p0 through r49p3, and r50p0 through r51p0 Arm Ltd Valhall GPU Userspace Driver versions r48p0 through r49p3, and r50p0 through r54p0 Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver versions r48p0 through r49p3, and r50p0 through r54p0 **Description** A Use After Free vulnerability exists in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, and Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver. This allows a non-privileged user process to perform GPU processing operations, including via WebGL or WebGPU, to gain access to already freed memory. **Recommendations** Arm Ltd Bifrost GPU Userspace Driver versions r48p0 through r49p3, and r50p0 through r51p0: Update to a newer version. Arm Ltd Valhall GPU Userspace Driver versions r48p0 through r49p3, and r50p0 through r54p0: Update to a newer version. Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver versions r48p0 through r49p3, and r50p0 through r54p0: Update to a newer version.

**Name of the Vulnerable Software and Affected Versions** visionOS versions prior to 2.2 tvOS versions prior to 18.2 Safari versions prior to 18.2 watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 **Description** The issue is related to the processing of maliciously crafted web content, which may lead to memory corruption due to a buffer overflow in the Web Handler component. This can potentially allow a remote attacker to access confidential information. The problem was solved with improved memory handling. **Recommendations** For visionOS versions prior to 2.2, update to visionOS 2.2 or later. For tvOS versions prior to 18.2, update to tvOS 18.2 or later. For Safari versions prior to 18.2, update to Safari 18.2 or later. For watchOS versions prior to 11.2, update to watchOS 11.2 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 or later.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 127 Firefox ESR versions prior to 115.12 Thunderbird versions prior to 115.12 Description: The issue is related to a use-after-free condition that could occur during object transplant in JavaScript, potentially allowing a remote attacker to execute arbitrary code or cause a denial of service. This is due to the garbage collection mechanism being triggered at a specific time, leading to the use-after-free condition. Recommendations: For Firefox versions prior to 127, update to version 127 or later to resolve the issue. For Firefox ESR versions prior to 115.12, update to version 115.12 or later to resolve the issue. For Thunderbird versions prior to 115.12, update to version 115.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 127 **Description** The issue is related to a use-after-free in the JavaScript engine, allowing an attacker to read memory in the JavaScript string section of the heap. This could enable a remote attacker to access confidential data. **Recommendations** For versions prior to 127, update to version 127 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 126 **Description** The issue is related to a missing iterator stop condition when handling WASM code in the built-in profiler. This could lead to invalid memory access and undefined behavior, potentially allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service. The issue only affects the application when the profiler is running. **Recommendations** For versions prior to 126, update to version 126 or later to resolve the issue. As a temporary workaround, consider disabling the profiler until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 125 **Description** The issue is related to a buffer overflow in the js::CheckTracedThing() function of the Mozilla Firefox JIT compiler. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is caused by the possibility of mutating a JavaScript object in such a way that it crashes the JIT while tracing it. **Recommendations** For versions prior to 125, update to version 125 or later to resolve the issue. As a temporary workaround, consider restricting the use of JavaScript objects that could potentially cause the JIT to crash until a patch is available.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 125 Description: The issue is related to the JIT component of the Mozilla Firefox browser, which incorrectly optimizes MSubstr operations, leading to out-of-bounds reads. This can allow a remote attacker to disclose protected information. Recommendations: For versions prior to 125, update to version 125 or later to resolve the issue. As a temporary workaround, consider disabling the JIT compiler until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 125 Firefox ESR versions prior to 115.10 Thunderbird versions prior to 115.10 **Description** The issue is related to the JIT compiler incorrectly optimizing switch statements, resulting in out-of-bounds reads. This can potentially allow a remote attacker to disclose protected information. **Recommendations** For Firefox versions prior to 125, update to version 125 or later. For Firefox ESR versions prior to 115.10, update to version 115.10 or later. For Thunderbird versions prior to 115.10, update to version 115.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 125 Firefox ESR versions prior to 115.10 Thunderbird versions prior to 115.10 **Description** The issue is related to the Garbage Collector component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client, involving the use of memory after it has been freed. This can lead to potential use-after-free crashes during garbage collection, allowing a remote attacker to execute arbitrary code. The problem arises from the JIT creating incorrect code for arguments in certain cases. **Recommendations** For Firefox versions prior to 125, update to version 125 or later. For Firefox ESR versions prior to 115.10, update to version 115.10 or later. For Thunderbird versions prior to 115.10, update to version 115.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 122 **Description** The issue is related to a dereferencing of an untrusted pointer, which could allow a remote attacker to execute arbitrary code. In certain circumstances, JIT compiled code could dereference a wild pointer value, leading to an exploitable crash. **Recommendations** For versions prior to 122, update to version 122 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 118 Firefox ESR versions prior to 115.3 Thunderbird versions prior to 115.3 **Description** The issue is related to a use-after-free condition that could occur during Ion compilation due to Garbage Collection, potentially allowing an attacker to write two NUL bytes and cause a crash. This could result in a denial of service. **Recommendations** For Firefox versions prior to 118, update to version 118 or later. For Firefox ESR versions prior to 115.3, update to version 115.3 or later. For Thunderbird versions prior to 115.3, update to version 115.3 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 117 Firefox ESR versions prior to 115.2 Thunderbird versions prior to 115.2 **Description** The issue is related to the `UpdateRegExpStatics` function attempting to access `initialStringHeap`, which could have been garbage collected prior to entering the function, potentially leading to an exploitable crash. This could allow a remote attacker to execute arbitrary code. **Recommendations** For Firefox versions prior to 117, update to version 117 or later. For Firefox ESR versions prior to 115.2, update to version 115.2 or later. For Thunderbird versions prior to 115.2, update to version 115.2 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 17.5 tvOS versions prior to 17.5 visionOS versions prior to 1.2 iOS versions prior to 17.5 iPadOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 **Description** The issue is related to improved memory handling and may lead to arbitrary code execution when processing web content. It is associated with access to a memory cell before the start of a buffer in WPE WebKit and WebKitGTK modules, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For Safari versions prior to 17.5, update to version 17.5 or later. For tvOS versions prior to 17.5, update to version 17.5 or later. For visionOS versions prior to 1.2, update to version 1.2 or later. For iOS versions prior to 17.5, update to version 17.5 or later. For iPadOS versions prior to 17.5, update to version 17.5 or later. For watchOS versions prior to 10.5, update to version 10.5 or later. For macOS Sonoma versions prior to 14.5, update to version 14.5 or later.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 112 Focus for Android versions prior to 112 Firefox ESR versions prior to 102.10 Firefox for Android versions prior to 112 Thunderbird versions prior to 102.10 **Description** The issue is related to a Garbage Collector compaction, where weak maps may have been accessed before they were correctly traced, resulting in memory corruption and a potentially exploitable crash. This can allow a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability is associated with a buffer overflow in the memory during the tracing process. **Recommendations** For Mozilla Firefox versions prior to 112, update to version 112 or later. For Focus for Android versions prior to 112, update to version 112 or later. For Firefox ESR versions prior to 102.10, update to version 102.10 or later. For Firefox for Android versions prior to 112, update to version 112 or later. For Thunderbird versions prior to 102.10, update to version 102.10 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 112 Firefox for Android versions prior to 112 Focus for Android versions prior to 112 **Description** The issue relates to a call to the `bind` function potentially resulting in the incorrect realm, which may create a vulnerability concerning JavaScript-implemented sandboxes such as SES. **Recommendations** For Firefox versions prior to 112, update to version 112 or later. For Firefox for Android versions prior to 112, update to version 112 or later. For Focus for Android versions prior to 112, update to version 112 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 111 Firefox ESR versions prior to 102.9 Thunderbird versions prior to 102.9 **Description** The issue is related to incorrect management of code generation, potentially leading to a crash when invalidating JIT code while following an iterator. This could allow a remote attacker to cause a denial of service or possibly other impacts. **Recommendations** For Firefox versions prior to 111, update to version 111 or later to resolve the issue. For Firefox ESR versions prior to 102.9, update to version 102.9 or later to resolve the issue. For Thunderbird versions prior to 102.9, update to version 102.9 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 111 Firefox ESR versions prior to 102.9 Thunderbird versions prior to 102.9 **Description** The issue is related to the implementation of AudioWorklets, where some code may have casted one type to another, invalid, dynamic type, potentially leading to a crash. This could be exploited by a remote attacker to cause a denial of service. **Recommendations** For Firefox versions prior to 111, update to version 111 or later. For Firefox ESR versions prior to 102.9, update to version 102.9 or later. For Thunderbird versions prior to 102.9, update to version 102.9 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 112 Firefox for Android versions prior to 112 Focus for Android versions prior to 112 **Description** The issue is related to uncontrolled resource exhaustion. If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a potentially exploitable crash. This could allow a remote attacker to cause a denial of service. **Recommendations** For Firefox versions prior to 112, update to version 112 or later. For Firefox for Android versions prior to 112, update to version 112 or later. For Focus for Android versions prior to 112, update to version 112 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 110 **Description** The issue is related to errors in type conversion, which could lead to undefined behavior due to an invalid downcast from `nsHTMLDocument` to `nsIContent`. This may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For versions prior to 110, update to version 110 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 110 Mozilla Firefox ESR versions prior to 102.8 Mozilla Thunderbird versions prior to 102.8 **Description** The issue is related to an invalid downcast from `nsTextNode` to `SVGElement`, which could lead to undefined behavior. This may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. **Recommendations** For Mozilla Firefox versions prior to 110, update to version 110 or later. For Mozilla Firefox ESR versions prior to 102.8, update to version 102.8 or later. For Mozilla Thunderbird versions prior to 102.8, update to version 102.8 or later.