Brendon Tiszka

توجد مشكلة تسرب للمعلومات حيث قد يؤدي زيارة موقع ويب مصمم بشكل خبيث إلى الكشف عن بيانات حساسة. ويحدث ذلك بسبب عدم كفاية عملية التحقق من الصحة.

توجد مشكلة قراءة خارج الحدود في libimagecodec.quram.so. وهذا يسمح لمهاجم عن بُعد بالوصول إلى الذاكرة خارج الحدود المقصودة. توجد هذه المشكلة في الإصدارات السابقة لـ SMR Jan-2026 Release 1.

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 Safari versions prior to 18.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: The issue was addressed with improved checks. Processing maliciously crafted web content may lead to an unexpected process crash. Recommendations: For watchOS versions prior to 11.2, update to watchOS 11.2 or later. For visionOS versions prior to 2.2, update to visionOS 2.2 or later. For tvOS versions prior to 18.2, update to tvOS 18.2 or later. For macOS Sequoia versions prior to 15.2, update to macOS Sequoia 15.2 or later. For Safari versions prior to 18.2, update to Safari 18.2 or later. For iOS versions prior to 18.2, update to iOS 18.2 or later. For iPadOS versions prior to 18.2, update to iPadOS 18.2 or later.

A type confusion issue exists in the V8 JavaScript engine. This flaw allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to visit a specially crafted HTML page. Type confusion occurs when a program accesses a resource using a different type than the one it was originally created with, leading to memory corruption or unexpected behavior. There are reports of this issue being exploited in the wild.

The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker to obtain potentially sensitive information from process memory. This can be achieved via a crafted HTML page.

The issue is related to an inappropriate implementation in Fenced Frames, allowing a remote attacker who has compromised the renderer process to bypass navigation restrictions via a crafted HTML page. This could potentially lead to unauthorized access to confidential data, disruption of data integrity, and denial of service.

The issue is related to an out of bounds write in WebRTC, which can be exploited by a remote attacker using crafted WebRTC packets, potentially leading to heap corruption. This could impact the confidentiality, integrity, and availability of protected information.

The issue is related to a use after free in navigation, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service.

The issue is related to an out of bounds memory access in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to confidential information or cause a denial of service. The vulnerability is associated with the Array.prototype.concat implementation in V8.

The issue is related to a use-after-free error in the V8 JavaScript engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved through a specially crafted HTML page. The problem arises from a reentrancy issue in JavaScript handling.