USN-1924-1 修复了 Firefox 中的漏洞。此更新提供针对 Ubufox 和 Unity Firefox Extension 的相应更新。

Jeff Gilbert、Henrik Skupin、Ben Turner、Christian Holler、Andrew McCreight、Gary Kwong、Jan Varga 和 Jesse Ruderman 在 Firefox 中发现多个内存安全问题。如果用户受到诱骗打开特别构建的页面，攻击者可能利用这些缺陷，通过应用程序崩溃造成拒绝服务，或可能以调用 Firefox 的用户权限执行任意代码。（CVE-2013-1701、CVE-2013-1702）

在 SetBody 突变事件期间修改 DOM 时发现释放后使用缺陷。如果用户受到诱骗打开特别构建的页面，攻击者可能利用此漏洞，以调用 Firefox 的用户的权限执行任意代码。(CVE-2013-1704)

在使用特定参数生成 CRMF 请求时发现释放后使用缺陷。如果用户受到诱骗打开特别构建的页面，攻击者可能利用此漏洞，以调用 Firefox 的用户的权限执行任意代码。(CVE-2013-1705)

Aki Helin 发现在某些情况下解码 WAV 文件时出现崩溃。攻击者可能利用该漏洞造成拒绝服务。(CVE-2013-1708)

已发现文档的 URI 可设置为其他文档的 URI。攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。
(CVE-2013-1709)

当在特定情况下生成 CRMF 请求时发现一个缺陷。攻击者可能利用此缺陷执行跨站脚本 (XSS) 攻击，或以调用 Firefox 的用户的权限执行任意代码。(CVE-2013-1710)

Bobby Holley 发现在特定情况下，可使用 XBL 范围避开 XrayWrapper。攻击者可能利用此问题进行跨站脚本 (XSS) 攻击或造成不明行为。(CVE-2013-1711)

Cody Crews 发现一些 JavaScript 组件对错误的 URI 执行了安全检查，从而可能绕过同源策略限制。攻击者可利用此问题进行跨站脚本 (XSS) 攻击或从恶意网站安装附加组件。(CVE-2013-1713)

Federico Lanusse 发现，当使用 XMLHttpRequest 时，Web 工作线程可绕过同源检查。攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2013-1714)

Georgi Guninski 和 John Schoenick 发现，Java 小程序可在特定情况下访问本地文件。攻击者可能利用此漏洞窃取机密数据。(CVE-2013-1717)。

来自 Red Hat 安全公告 2013:1140：

更新后的 firefox 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux 5 和 6。

Red Hat 安全响应团队已将此更新评级为具有严重安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

Mozilla Firefox 是一款开源 Web 浏览器。XULRunner 提供用于 Mozilla Firefox 的 XUL Runtime 环境。

在对畸形 Web 内容的处理中发现多个缺陷。包含恶意内容的网页可导致 Firefox 崩溃，或者可能以运行 Firefox 的用户的权限执行任意代码。(CVE-2013-1701)

在 Firefox 生成证书请求消息格式 (CRMF) 请求的方式中发现一个缺陷。攻击者可利用此缺陷执行跨站脚本 (XSS) 攻击，或以运行 Firefox 的用户的权限执行任意代码。(CVE-2013-1710)

在 Firefox 处理框架和浏览器历史记录之间的交互的方式中发现一个缺陷。攻击者可利用此缺陷欺骗 Firefox，使其将恶意内容视为来自浏览器历史记录的内容，从而导致 XSS 攻击。(CVE-2013-1709)

已发现在 JavaScript 中检查统一资源标识符 (URI) 的方式允许绕过同源策略。攻击者可利用此缺陷发起 XSS 攻击，或安装来自第三方页面的恶意附加组件。(CVE-2013-1713)

已发现 Web 工作线程可绕过同源策略。攻击者可利用此缺陷发起 XSS 攻击。(CVE-2013-1714)

已发现在特定情况下，Firefox 没有正确处理 Java 小程序。如果用户通过 Firefox 启动不受信任的 Java 小程序，则该小程序可利用此缺陷获得用户本地系统中文件的只读访问权限。(CVE-2013-1717)

Red Hat 在此感谢 Mozilla 项目报告这些问题。上游感谢这些问题的原始报告者 Jeff Gilbert、Henrik Skupin、moz_bug_r_a4、Cody Crews、Federico Lanusse 和 Georgi Guninski。

有关这些缺陷的技术详细信息，请参阅 Firefox 17.0.8 ESR 的 Mozilla 安全公告。在本勘误表的“参考”部分可以找到 Mozilla 公告的链接。

所有 Firefox 用户应升级这些更新后的程序包，其中包含已修正了这些问题的 Firefox 版本 17.0.8 ESR。安装更新后，必须重新启动 Firefox 才能使更改生效。

Jeff Gilbert 和 Henrik Skupin 在 Thunderbird 中发现多种内存安全问题。如果用户受到诱骗打开特别构建的启用了脚本的消息，攻击者可能会利用这些问题，通过应用程序崩溃来造成拒绝服务，或者可能以调用 Thunderbird 的用户的权限执行任意代码。(CVE-2013-1701)

已发现文档的 URI 可设置为其他文档的 URI。如果用户启用了脚本，攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2013-1709)

当在特定情况下生成 CRMF 请求时发现一个缺陷。如果用户启用了脚本，攻击者可能会利用此缺陷来进行跨站脚本 (XSS) 攻击，或者以调用 Thunderbird 的用户的权限执行任意代码。(CVE-2013-1710)

Cody Crews 发现一些 JavaScript 组件对错误的 URI 执行了安全检查，从而可能绕过同源策略限制。如果用户启用了脚本，攻击者可利用此缺陷来进行跨站脚本 (XSS) 攻击，或者安装来自恶意站点的附加组件。(CVE-2013-1713)

Federico Lanusse 发现，当使用 XMLHttpRequest 时，Web 工作线程可绕过同源检查。如果用户启用了脚本，攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2013-1714)

Georgi Guninski 和 John Schoenick 发现，Java 小程序可在特定情况下访问本地文件。如果用户启用了脚本，攻击者可能会利用此问题来窃取机密数据。(CVE-2013-1717)。

安装的 Firefox 版本低于 23.0，因此可能受到多种漏洞的影响：

- 存在可能允许内存损坏情况的各种错误。（CVE-2013-1701、CVE-2013-1702）

- 使用“SetBody”并生成“证书请求消息”时，存在关于 DOM 修改的释放后使用错误。（CVE-2013-1704、CVE-2013-1705）

- 函数“nsCString::CharAt”存在错误，可导致应用程序在解码特别构建的 WAV 音频文件时崩溃。(CVE-2013-1708)

- 存在关于 HTML 框架和历史记录处理、“XrayWrappers”、JavaScript URI 处理和使用“XMLHttpRequest”的 Web 工作线程的不明错误，可允许跨站脚本攻击。
 （CVE-2013-1709、CVE-2013-1711、CVE-2013-1713、CVE-2013-1714）

- 存在关于生成“证书请求消息格式” (CRMF) 请求的不明错误，可允许跨站脚本攻击。
 (CVE-2013-1710)

- 存在与 Java 小程序和“file:///”URI 有关的错误，可允许对任意文件进行只读访问。(CVE-2013-1717)

安装的 Thunderbird 版本低于 17.0.8，因此可能受以下漏洞影响：

- 存在可能允许内存损坏情况的各种错误。（CVE-2013-1701、CVE-2013-1702）

- 使用“SetBody”并生成“证书请求消息”时，存在关于 DOM 修改的释放后使用错误。（CVE-2013-1704、CVE-2013-1705）

- 函数“nsCString::CharAt”存在错误，可导致应用程序在解码特别构建的 WAV 音频文件时崩溃。(CVE-2013-1708)

- 存在关于 HTML 框架和历史记录处理、“XrayWrappers”、JavaScript URI 处理和使用“XMLHttpRequest”的 Web 工作线程的不明错误，可允许跨站脚本攻击。
 （CVE-2013-1709、CVE-2013-1711、CVE-2013-1713、CVE-2013-1714）

- 存在关于生成“证书请求消息格式” (CRMF) 请求的不明错误，可允许跨站脚本攻击。
 (CVE-2013-1710)

- 存在与 Java 小程序和“file:///”URI 有关的错误，可允许对任意文件进行只读访问。(CVE-2013-1717)

安装的 Thunderbird ESR 17.x 版本低于 17.0.8，因此可能受到以下漏洞的影响：

- 存在可能允许内存损坏情况的各种错误。(CVE-2013-1701)

- 存在关于 HTML 框架和历史记录处理、JavaScript URI 处理和使用“XMLHttpRequest”的 Web 工作线程的不明错误，可能允许跨站脚本攻击。（CVE-2013-1709、CVE-2013-1713、CVE-2013-1714）

- 存在关于生成“证书请求消息格式” (CRMF) 请求的不明错误，可允许跨站脚本攻击。
 (CVE-2013-1710)

- 存在与 Java 小程序和“file:///”URI 有关的错误，可允许对任意文件进行只读访问。(CVE-2013-1717)

安装的 Firefox ESR 17.x 版本低于 17.0.8，因此可能受到以下漏洞的影响：

- 存在可能允许内存损坏情况的各种错误。(CVE-2013-1701)

- 存在关于 update 服务和“maintenanceservice.exe”的错误，可能导致缓冲区在处理意外的长路径值时溢出。
 （CVE-2013-1706、CVE-2013-1707）

- 存在关于 HTML 框架和历史记录处理、JavaScript URI 处理和使用“XMLHttpRequest”的 Web 工作线程的不明错误，可能允许跨站脚本攻击。（CVE-2013-1709、CVE-2013-1713、CVE-2013-1714）

- 存在关于生成“证书请求消息格式” (CRMF) 请求的不明错误，可允许跨站脚本攻击。
 (CVE-2013-1710)

- 存在关于 update 服务的 DLL 路径加载错误，可允许执行任意代码。
 请注意，该问题影响 Microsoft Windows 7 和更高版本。(CVE-2013-1712)

- 存在与 Java 小程序和“file:///”URI 有关的错误，可允许对任意文件进行只读访问。(CVE-2013-1717)

远程主机受到 GLSA-201309-23 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Mozilla Firefox、Thunderbird 和 SeaMonkey 中发现多种漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可进行 XSS 攻击、欺骗 URL、绕过地址空间布局随机化、进行点击劫持攻击、获取潜在敏感信息、绕过访问限制、修改本地文件系统或进行其他不明攻击。
 变通方案：

目前无任何已知的变通方案。

Versions of Mozilla Firefox earlier than version 23.0 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - A DLL hijacking vulnerability occurs that leads to arbitrary code execution. This issue affects the Firefox Full installer and Stub installer. (CVE-2013-1715)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of Mozilla Firefox prior to version 17.0.8 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities :

 - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)
 - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)
 - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)
 - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)
 - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)
 - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)
 - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)
 - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)
 - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)
 - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)
 - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)
 - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)
 - Stored cross-site scripting vulnerability due to insufficient input validation of 'data:' URLs in iframe elements. (CVE-2013-6674)

Versions of Mozilla Firefox earlier than version 23.0 are prone to the following vulnerabilities:

  - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)

  - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)

  - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)

  - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)

  - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)

  - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)

  - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)

  - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of Mozilla SeaMonkey earlier than version 2.20 are prone to the following vulnerabilities:

  - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)

  - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)

  - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)

  - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)

  - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)

  - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)

  - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)

  - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)

  - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)

  - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)

  - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)

  - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

Versions of Mozilla Firefox earlier than version 23.0 are prone to the following vulnerabilities:

  - Multiple memory-corruption vulnerabilities exist in the browser engine that could lead to arbitrary code execution. (CVE-2013-1701, CVE-2013-1702)

  - A use-after-free vulnerability occurs when the Document Object Model is modified during a SetBody mutation event. (CVE-2013-1704)

  - A use-after-free vulnerability occurs when generating a Certificate Request Message Format (CRMF) request with certain parameters. (CVE-2013-1705)

  - Multiple stack-based buffer overflow vulnerabilities occur in both the Maintenance Service and the Mozilla Updater when unexpectedly long paths were encountered. (CVE-2013-1706, CVE-2013-1707)

  - A denial-of-service vulnerability occurs when decoding of 'WAV' format audio files. (CVE-2013-1708)

  - A cross-site scripting vulnerability affects the application. An attacker can exploit this issue through an interaction of frames and browser history. (CVE-2013-1709)

  - A remote code execution and cross-site scripting vulnerability occurs when generating a Certificate Request Message Format (CRMF) request. (CVE-2013-1710)

  - A cross-site scripting vulnerability occurs by bypassing XrayWrappers from within the Chrome on unprivileged objects, using XBL Scopes. (CVE-2013-1711)

  - A privilege-escalation vulnerability occurs due to an error when using Mozilla Updater. An attacker can exploit this issue to load a specific malicious DLL file from the local system using the Mozilla Updater, and can able to execute the DLL in a privileged context through the Mozilla Maintenance Service's privileges. (CVE-2013-1712)

  - A same-origin security-bypass vulnerability exists because wrong principal is used for validating URI for some Javascript components. (CVE-2013-1713)

  - A same-origin security-bypass vulnerability occurs due to an error with web workers and XMLHttpRequest. (CVE-2013-1714)

  - A DLL hijacking vulnerability occurs that leads to arbitrary code execution. This issue affects the Firefox Full installer and Stub installer. (CVE-2013-1715)

  - An information-disclosure vulnerability occurs due to an unspecified error with Java applets. This issue leads to disclose contents of local file system when loaded using the a 'file:/// URI'. (CVE-2013-1717)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
69235	Ubuntu 12.04 LTS / 12.10 / 13.04：ubufox、unity-firefox-extension 更新 (USN-1924-2)	Nessus	Ubuntu Local Security Checks	2013/8/7	2019/9/19	critical
69251	Oracle Linux 5 / 6：firefox (ELSA-2013-1140)	Nessus	Oracle Linux Local Security Checks	2013/8/8	2021/1/14	critical
69260	Ubuntu 12.04 LTS / 12.10 / 13.04：thunderbird 漏洞 (USN-1925-1)	Nessus	Ubuntu Local Security Checks	2013/8/8	2019/9/19	critical
69265	Firefox < 23.0 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/8/8	2019/11/27	critical
69266	Thunderbird < 17.0.8 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/8/8	2019/11/27	critical
69267	Thunderbird ESR 17.x < 17.0.8 多种漏洞 (Mac OS X)	Nessus	MacOS X Local Security Checks	2013/8/8	2019/11/27	critical
69268	Firefox ESR 17.x < 17.0.8 多种漏洞	Nessus	Windows	2013/8/8	2019/11/27	critical
70183	GLSA-201309-23：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	2013/9/28	2022/3/29	critical
6978	Mozilla Firefox < 23.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/8/8	2019/3/6	high
6979	Mozilla Thunderbird < 17.0.8 Multiple Vulnerabilities	Nessus Network Monitor	SMTP Clients	2013/8/8	2019/3/6	high
6977	SeaMonkey < 2.20 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2013/8/8	2019/3/6	high
801464	Mozilla Thunderbird < 17.0.8 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/8/8		medium
801462	Mozilla SeaMonkey < 2.20 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/8/8		medium
801463	Mozilla Firefox < 23.0 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	2013/8/8		medium

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

medium

medium

medium