Manfred Paul

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 138.0.4 Firefox ESR versions prior to 128.10.1 Firefox ESR versions prior to 115.23.1 Thunderbird versions prior to 128.10.2 Thunderbird versions prior to 138.0.2 **Description** The vulnerability is related to an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This could potentially result in the execution of arbitrary code. An attacker was able to exploit this issue to win $50,000 in a Pwn2Own competition. **Recommendations** For Firefox versions prior to 138.0.4, upgrade to version 138.0.4 or later. For Firefox ESR versions prior to 128.10.1, upgrade to version 128.10.1 or later. For Firefox ESR versions prior to 115.23.1, upgrade to version 115.23.1 or later. For Thunderbird versions prior to 128.10.2, upgrade to version 128.10.2 or later. For Thunderbird versions prior to 138.0.2, upgrade to version 138.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 123.0.6312.86 Microsoft Edge (affected versions not specified) **Description** A type confusion issue exists within the WebAssembly module of the browser. This occurs because the WASM module decoder lacks a proper check of the type section size in a branch of the `DecodeTypeSection()` function. A remote attacker can exploit this by inducing the browser to load a specially crafted HTML page, which may lead to arbitrary code execution, denial of service, or information disclosure. **Recommendations** Update Google Chrome to version 123.0.6312.86 or later. At the moment, there is no information about a newer version that contains a fix for this vulnerability for Microsoft Edge.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 124.0.1 Firefox ESR versions prior to 115.9.1 **Description** An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. This issue affects Desktop Firefox only and does not affect mobile versions of Firefox. The vulnerability is related to incorrect event handling due to improper code generation management. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges and execute arbitrary code. **Recommendations** For Firefox versions prior to 124.0.1, update to version 124.0.1 or later. For Firefox ESR versions prior to 115.9.1, update to version 115.9.1 or later. As a temporary workaround, consider disabling the execution of JavaScript in the parent process until a patch is available. Restrict access to privileged objects to minimize the risk of exploitation. Avoid using event handlers in the affected Firefox versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 124.0.1 **Description** The issue is related to an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This can allow an attacker to read outside the expected values or execute arbitrary code remotely. The vulnerability is associated with the SpiderMonkey JIT Compiler. **Recommendations** For Firefox versions prior to 124.0.1, update to version 124.0.1 or later to resolve the issue. As a temporary workaround, consider disabling the JavaScript engine or restricting its use until a patch is available. Avoid using the `MObjectKeysLength::computeRange` function in the IonMonkey until the issue is resolved. Restrict access to the SpiderMonkey JIT Compiler to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** tvOS versions prior to 17.5 iOS versions prior to 16.7.8 and prior to 17.5 iPadOS versions prior to 16.7.8 and prior to 17.5 visionOS version prior to 1.2 Safari version prior to 17.5 **Description** An integer overflow was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution. A remote attacker may be able to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For tvOS versions prior to 17.5, update to tvOS 17.5. For iOS versions prior to 16.7.8, update to iOS 16.7.8. For iOS versions prior to 17.5, update to iOS 17.5. For iPadOS versions prior to 16.7.8, update to iPadOS 16.7.8. For iPadOS versions prior to 17.5, update to iPadOS 17.5. For visionOS version prior to 1.2, update to visionOS 1.2. For Safari version prior to 17.5, update to Safari 17.5.

**Name of the Vulnerable Software and Affected Versions** ZoneMinder versions prior to 1.36.33 ZoneMinder versions prior to 1.37.33 **Description** The issue is related to an SQL Injection in ZoneMinder, a free, open source Closed-circuit television software application for Linux. The `minTime` and `maxTime` request parameters are not properly validated, allowing them to be used to execute arbitrary SQL. **Recommendations** For versions prior to 1.36.33, update to version 1.36.33 or later. For versions prior to 1.37.33, update to version 1.37.33 or later.

**Name of the Vulnerable Software and Affected Versions** ZoneMinder versions prior to 1.36.33 ZoneMinder versions prior to 1.37.33 **Description** The issue concerns a Local File Inclusion vulnerability via the "web/ajax/modal.php" endpoint, where an arbitrary php file path can be passed in the request and loaded. **Recommendations** For versions prior to 1.36.33, update to version 1.36.33 or later. For versions prior to 1.37.33, update to version 1.37.33 or later.

**Name of the Vulnerable Software and Affected Versions** Apple Safari iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, macOS Sonoma 14.5 WebKitGTK versions prior to 2.44.2 WebKit2GTK versions prior to 2.44.2 **Description** This issue addresses a vulnerability where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. The vulnerability affects Apple Safari, WebKitGTK, and WPE WebKit. Multiple reports indicate that this flaw could lead to code execution. The issue has been addressed with improved checks in versions iOS 17.5 and iPadOS 17.5, tvOS 17.5, Safari 17.5, watchOS 10.5, macOS Sonoma 14.5, and WebKitGTK versions 2.44.2 and later. **Recommendations** Update Apple Safari to iOS 17.5 and iPadOS 17.5, tvOS 17.5, watchOS 10.5, or macOS Sonoma 14.5. Update WebKitGTK to version 2.44.2 or later. Update WPE WebKit to version 2.44.2 or later.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 8.7 tvOS versions prior to 15.6 iOS versions prior to 15.6 iPadOS versions prior to 15.6 macOS Monterey versions prior to 12.5 **Description** The issue allows UI spoofing when visiting a website that frames malicious content. This can lead to potential security risks. **Recommendations** For watchOS versions prior to 8.7, update to watchOS 8.7 to resolve the issue. For tvOS versions prior to 15.6, update to tvOS 15.6 to resolve the issue. For iOS versions prior to 15.6, update to iOS 15.6 to resolve the issue. For iPadOS versions prior to 15.6, update to iPadOS 15.6 to resolve the issue. For macOS Monterey versions prior to 12.5, update to macOS Monterey 12.5 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 102 Firefox ESR versions prior to 91.11 Thunderbird versions prior to 102 Thunderbird versions prior to 91.11 **Description** The issue is related to incorrect input validation when handling JavaScript attributes, which could allow a remote attacker to execute arbitrary JavaScript code by corrupting an object prototype and setting undesired attributes on a JavaScript object, leading to privileged code execution. **Recommendations** For Firefox versions prior to 102, update to version 102 or later. For Firefox ESR versions prior to 91.11, update to version 91.11 or later. For Thunderbird versions prior to 102, update to version 102 or later. For Thunderbird versions prior to 91.11, update to version 91.11 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 91.9.1 Firefox versions prior to 100.0.2 Firefox for Android versions prior to 100.3.0 Thunderbird versions prior to 91.9.1 **Description** The issue is related to errors in processing input data, which can lead to prototype pollution and allow an attacker to execute attacker-controlled JavaScript in the privileged parent process. This can occur when an attacker sends a message to the parent process, where the contents are used to double-index into a JavaScript object. **Recommendations** For Firefox ESR versions prior to 91.9.1, update to version 91.9.1 or later. For Firefox versions prior to 100.0.2, update to version 100.0.2 or later. For Firefox for Android versions prior to 100.3.0, update to version 100.3.0 or later. For Thunderbird versions prior to 91.9.1, update to version 91.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Firefox ESR versions prior to 91.9.1 Firefox versions prior to 100.0.2 Firefox for Android versions prior to 100.3.0 Thunderbird versions prior to 91.9.1 **Description** The issue is related to prototype pollution in the Array object in JavaScript, allowing an attacker to execute attacker-controlled JavaScript code in a privileged context. This can be achieved by corrupting the methods of an Array object. The estimated number of potentially affected devices is not provided. **Recommendations** For Firefox ESR versions prior to 91.9.1, update to version 91.9.1 or later. For Firefox versions prior to 100.0.2, update to version 100.0.2 or later. For Firefox for Android versions prior to 100.3.0, update to version 100.3.0 or later. For Thunderbird versions prior to 91.9.1, update to version 91.9.1 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 92.0.4515.159 **Description** The issue is related to a type confusion in the V8 JavaScript engine, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This can be achieved by exploiting errors in data type mixing. **Recommendations** For versions prior to 92.0.4515.159, update to version 92.0.4515.159 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 92.0.4515.159 **Description** The issue is related to a type confusion in the V8 JavaScript engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox. This can be achieved via a crafted HTML page. **Recommendations** For versions prior to 92.0.4515.159, update to version 92.0.4515.159 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 5.13-rc4 Linux kernel versions 5.7-rc1 through 5.12.3 Linux kernel versions 5.10-rc1 through 5.10.36 Linux kernel versions 5.11 through 5.11.20 **Description** The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue is related to a buffer overflow in memory, allowing an attacker to execute arbitrary code in the context of the kernel. **Recommendations** For Linux kernel versions prior to 5.13-rc4, update to version 5.13-rc4 or later. For Linux kernel versions 5.7-rc1 through 5.12.3, update to version 5.12.4 or later. For Linux kernel versions 5.10-rc1 through 5.10.36, update to version 5.10.37 or later. For Linux kernel versions 5.11 through 5.11.20, update to version 5.11.21 or later. As a temporary workaround, consider disabling the eBPF functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Linux Kernel version 5.11.15 **Description** This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of eBPF programs, resulting from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel. **Recommendations** For Linux Kernel version 5.11.15, consider disabling the handling of eBPF programs as a temporary workaround until a patch is available. Restrict access to the eBPF subsystem to minimize the risk of exploitation. Avoid using the CAP SYS MODULE capability in containers to prevent attackers from loading arbitrary kernel modules. Implement seccomp to restrict system calls and reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 90.0.4430.93 Microsoft Edge (affected versions not specified) **Description** The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing for arbitrary code execution. The problem is associated with accessing a resource through incompatible types. **Recommendations** For Google Chrome versions prior to 90.0.4430.93, update to version 90.0.4430.93 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 5.4.7 through 5.4.28 Linux kernel versions 5.5.0 through 5.5.13 Linux kernel versions 5.6.0 through 5.6.0 **Description** The vulnerability is related to the bpf verifier in the Linux kernel, which did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This issue affects the Linux 5.4 stable series and newer versions. The vulnerability can be exploited to escalate privileges, allowing an attacker to gain root access. A working exploit exists but has not been publicly released. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, analyzing subsystems, and managing traffic within the kernel. **Recommendations** For Linux kernel versions 5.4.7 through 5.4.28, update to version 5.4.29 or later. For Linux kernel versions 5.5.0 through 5.5.13, update to version 5.5.14 or later. For Linux kernel versions 5.6.0 through 5.6.0, update to version 5.6.1 or later. As a temporary workaround, consider restricting access to the eBPF subsystem to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** ghostscript versions 9.x before 9.50 **Description** A flaw in the `.charkeys` procedure of ghostscript allows scripts to bypass `-dSAFER` restrictions by not properly securing its privileged calls. This enables an attacker to create a specially crafted PostScript file that could escalate privileges within Ghostscript, access files outside of restricted areas, or execute commands. The exploitation of this flaw may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. **Recommendations** For ghostscript versions 9.x before 9.50, update to version 9.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the `.charkeys` procedure to minimize the risk of exploitation. Avoid using the `-dSAFER` restrictions in affected versions until the issue is resolved.