CVE-2023-0767

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.(CVE-2020-15670)

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.(CVE-2020-15673)

Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81.(CVE-2020-15674)

When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81.(CVE-2020-15675)

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82.(CVE-2020-15680)

When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 82.(CVE-2020-15681)

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.(CVE-2020-15682)

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.(CVE-2020-15683)

Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.(CVE-2020-15684)

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.(CVE-2020-16012)

Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.(CVE-2020-16044)

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.(CVE-2020-26950)

(CVE-2020-26951)

(CVE-2020-26953) …

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security Fix(es):

Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80.(CVE-2020-15670)

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.(CVE-2020-15673)

Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81.(CVE-2020-15674)

When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 81.(CVE-2020-15675)

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82.(CVE-2020-15680)

When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 82.(CVE-2020-15681)

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.(CVE-2020-15682)

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.(CVE-2020-15683)

Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.(CVE-2020-15684)

Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page.(CVE-2020-16012)

Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet.(CVE-2020-16044)

In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. This vulnerability affects Firefox < 82.0.3, Firefox ESR < 78.4.1, and Thunderbird < 78.4.2.(CVE-2020-26950)

(CVE-2020-26951)

(CVE-2020-26953) …

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

• Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)

• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

• Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)

• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
• Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)
• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.8.0.

Security Fix(es):

• Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
• Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
• Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
• Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
• Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
• Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
• Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
• Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
• Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
• Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
• Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
• Mozilla: User Interface lockup with messages combining S/MIME and OpenPGP (CVE-2023-0616)
• Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

• nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

• nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

Bug Fix(es):

• In FIPS mode, nss should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator. (BZ#2177434)
• Need to update FIPS review comments into NSS AlmaLinux-9. (BZ#2177875)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-0767: nss: improve handling of unknown PKCS#12 safe bag types

• CVE-2023-0767: nss: improve handling of unknown PKCS#12 safe bag types

• SECURITY UPDATE: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled
  • debian/patches/CVE-2023-0767.patch: improve handling of unknown PKCS#12 safe bag types
  • CVE-2023-0767

• CVE-2023-0767: nss: improve handling of unknown PKCS#12 safe bag types

• CVE-2023-0767: nss: improve handling of unknown PKCS#12 safe bag types

An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled (CVE-2023-0767).

The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect (CVE-2023-25728).

Permission prompts for opening external schemes were only shown for ContentPrincipals resulting in extensions being able to open them without user interaction via ExpandedPrincipals. This could lead to further malicious actions such as downloading files or interacting with software already installed on the system (CVE-2023-25729).

A background script invoking requestFullscreen and then blocking the main thread could force the browser into fullscreen mode indefinitely, resulting in potential user confusion or spoofing attacks (CVE-2023-25730).

In EncodeInputStream, wen encoding data from an inputStream in xpcom the size of the input being encoded was not correctly calculated potentially leading to an out of bounds memory write (CVE-2023-25732).

In SpiderMonkey, cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free after unwrapping the proxy (CVE-2023-25735).

An invalid downcast from nsTextNode to SVGElement in SVGUtils::SetupStrokeGeometry could have lead to undefined behavior (CVE-2023-25737).

Module load requests that failed were not being checked as to whether or not they were cancelled causing a use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739).

In Web Crypto, when importing a SPKI RSA public key as ECDSA P-256, the key would be handled incorrectly causing the tab to crash (CVE-2023-25742).

Mozilla developers Philipp and Gabriele Svelto, Kershaw Chang, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 102.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2023-25744, CVE-2023-25746).

User Interface lockup with messages combining S/MIME and OpenPGP. (CVE-2023-0616)

Content security policy leak in violation reports using iframes. (CVE-2023-25728)

Screen hijack via browser fullscreen mode. (CVE-2023-25730)

Arbitrary memory write via PKCS 12 in NSS. (CVE-2023-0767)

Potential use-after-free from compartment mismatch in SpiderMonkey. (CVE-2023-25735)

Invalid downcast in SVGUtils::SetupStrokeGeometry. (CVE-2023-25737)

Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext. (CVE-2023-25739)

Extensions could have opened external schemes without user knowledge. (CVE-2023-25729)

Out of bounds memory write from EncodeInputStream. (CVE-2023-25732)

Web Crypto ImportKey crashes tab. (CVE-2023-25742)

Memory safety bugs fixed in Thunderbird 102.8. (CVE-2023-25746)

These are all security issues fixed in the libmozjs-102-0-102.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-102.8.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaFirefox-110.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

• nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.