Thomas

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 117.0.5938.132 **Description** The issue is related to a use after free in the Extensions component of Google Chrome, which could allow an attacker to exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. The severity of this issue is considered high. **Recommendations** For Google Chrome versions prior to 117.0.5938.132, update to version 117.0.5938.132 or later to resolve the issue. As a temporary workaround, consider disabling the installation of new extensions until the update is applied. Restrict access to potentially malicious HTML pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome on Android versions prior to 116.0.5845.96 **Description** The issue is related to an inappropriate implementation in the Autofill function of Google Chrome on Android, which can be exploited by a remote attacker to bypass existing security restrictions. This can be achieved via a specially crafted HTML page. **Recommendations** For versions prior to 116.0.5845.96, update to version 116.0.5845.96 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Autofill feature until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 102.0.5005.61 Microsoft Edge (affected versions not specified) **Description** The issue is related to insufficient policy enforcement in the File System API of Google Chrome and Microsoft Edge browsers. This can be exploited by an attacker, potentially allowing them to disclose protected information using a specially crafted web page. An attacker who convinces a user to install a malicious extension can bypass file system policy via a crafted HTML page. **Recommendations** For Google Chrome versions prior to 102.0.5005.61, update to version 102.0.5005.61 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shopware versions prior to 6.4.8.2 **Description** The issue arises from the improper setting of sensitive HTTP headers, making them cacheable. If an HTTP cache exists between the server and client, these headers may be exposed via HTTP caches. This affects Shopware, an open commerce platform based on the Symfony PHP framework and the Vue JavaScript framework. **Recommendations** For versions prior to 6.4.8.2, update to version 6.4.8.2 to resolve the issue. For older versions of 6.1, 6.2, and 6.3, consider installing a corresponding security plugin as a temporary measure, but updating to the latest Shopware version is recommended for the full range of functions.

Name of the Vulnerable Software and Affected Versions: Wireshark versions 0.9.7 through 1.0.2 Description: The issue is related to multiple buffer overflows in the packet ncp2222.inc file, which can be triggered by a crafted NCP packet. This can cause a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code due to an invalid pointer being used. Recommendations: For Wireshark versions 0.9.7 through 1.0.2, update to a version that contains a fix for this issue to prevent potential exploitation.