Michael Bommarito

**Name of the Vulnerable Software and Affected Versions** Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.14 Apache Traffic Server versions 10.0.0 through 10.1.3 **Description** Apache Traffic Server contains memory-safety errors that allow the system to write out of bounds or overflow integers during the parsing of MIME and HTTP headers. **Recommendations** Upgrade versions 8.0.0 through 9.2.14 to version 9.2.15. Upgrade versions 10.0.0 through 10.1.3 to version 10.1.4.

**Name of the Vulnerable Software and Affected Versions** Wireshark versions 4.6.0 through 4.6.6 Wireshark versions 4.4.0 through 4.4.16 **Description** A crash in the Catapult DCT2000 protocol dissector allows a denial of service. A protocol dissector is a software component that breaks down network traffic into a human-readable format. **Recommendations** Update Wireshark versions 4.6.0 through 4.6.6 to a newer version. Update Wireshark versions 4.4.0 through 4.4.16 to a newer version.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 140.12.1 Thunderbird versions prior to 152.0.1 **Description** A malicious LDAP server can cause the Thunderbird LDAP client to crash due to memory exhaustion. This occurs when the client is configured to query the server for address-book autocomplete, allowing the server to stash arbitrarily large amounts of attacker-supplied data into the client. **Recommendations** Update to version 140.12.1. Update to version 152.0.1.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 140.12.1 Thunderbird versions prior to 152.0.1 **Description** An attacker can inject arbitrary styled content, phishing links, and CSS to manipulate the chat UI by sending HTML chat messages via Matrix or XMPP. **Recommendations** Update to version 140.12.1. Update to version 152.0.1.