Atte Kettunen

يوجد تجاوز لسعة المخزن المؤقت (Buffer overflow) في ANGLE، وهي طبقة توافق تسمح بتشغيل واجهات برمجة تطبيقات OpenGL ES على المنصات غير الأصلية. تتيح هذه الثغرة للمهاجم عن بُعد تنفيذ رمز عشوائي خارج صندوق الحماية (sandbox) من خلال دفع المستخدم لزيارة صفحة HTML مصممة خصيصاً.

يحتوي مكون Audio/Video: Web Codecs على شروط حدودية غير صحيحة.

توجد مشكلة في مكون Graphics: WebGPU بسبب شروط حدودية غير صحيحة.

يوجد خلل في مكون Graphics: WebGPU بسبب شروط حدودية غير صحيحة.

يمكن للمهاجم التسبب في خطأ «use-after-free» عبر واجهة برمجة التطبيقات `Custom Highlight API`، مما يؤدي إلى ثغرة أمنية يمكن استغلالها.

The issue is related to the manipulation of the selection node cache, which may cause unexpected behavior and potentially lead to an exploitable crash. This could allow a remote attacker to cause a denial of service. The vulnerability is associated with incorrect clearance or release of resources in the Selection Node Cache component of Mozilla Firefox.

The issue is related to the use of `nsIInputStream` interfaces in Firefox, Firefox ESR, and Thunderbird, which could lead to a use-after-free condition and potentially exploitable crash. This could allow a remote attacker to execute arbitrary code.

A malicious webpage could cause an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. The issue is related to buffer copying without checking the size of input data in the WebGL API for 3D graphics in browsers. Exploitation of this issue may allow a remote attacker to cause a denial of service using a specially crafted malicious webpage.

The issue is related to a heap-buffer-overflow that could lead to a potentially exploitable crash, caused by applying a CSS filter effect that accesses out of bounds memory. This could allow a remote attacker to execute arbitrary code in the target system by exploiting the buffer overflow vulnerability in the `blendGaussianBlur` function of the affected software.

The issue is related to a use-after-free error, which occurs when memory is accessed after it has been freed. This could potentially lead to a crash and allow a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not specified.

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit, resulting in a potentially exploitable crash. The issue is related to a buffer overflow in the Skia library, which may allow a remote attacker to execute arbitrary code or cause a denial of service.

The issue is related to an integer overflow leading to use after free in PDFium, which can potentially allow a remote attacker to exploit heap corruption via a crafted PDF file.

The issue is related to improper handling of objects in memory, which could allow a remote attacker to execute arbitrary code in the context of the current user by using a specially crafted website. If the current user has administrative rights, the attacker could gain control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks.

A buffer overflow read occurs during SVG filter color value operations, resulting in data exposure.

A segmentation fault can occur during some bidirectional layout operations.

A buffer overflow in the WebGL component of the affected browsers and email client can be triggered by web content, potentially resulting in a crash. This issue may allow a remote attacker to cause a denial of service.

A memory corruption issue in Skia can occur when using transforms to make gradients, resulting in a potentially exploitable crash.

A buffer overflow in SkiaGl occurs when a GrGLBuffer is truncated during allocation, potentially leading to a crash when later writers overflow the buffer.

The issue incorrectly handled object lifecycles during shutdown, allowing a remote attacker to perform an out of bounds memory read via crafted HTML pages.