Brian Carpenter

توجد مشكلة تتعلق بتصعيد الصلاحيات داخل مكون «منع فقدان البيانات».

قد يؤدي معالجة محتوى ويب تم التلاعب به بشكل خبيث إلى توقف غير متوقع للعملية بسبب سوء إدارة الذاكرة.

يحدث استدعاء مؤشر NULL عند استلام خلية CERT بترتيب غير صحيح. استدعاء مؤشر NULL هو خطأ في وقت التشغيل يحدث عندما يحاول البرنامج القراءة أو الكتابة إلى عنوان ذاكرة قيمته NULL، مما يؤدي غالبًا إلى تعطل البرنامج.

قد تحدث عملية قراءة خارج نطاق الذاكرة بمقدار بايت واحد عند معالجة خلية BEGIN تالفة.

يخطئ Tor في معالجة حساب قائمة الانتظار غير المرتبة لـ «conflux» أثناء عملية مسح قائمة الانتظار.

قد يتعطل العميل عند حدوث ضغط على ذاكرة قائمة انتظار الدوائر نتيجة الإغلاق المزدوج لإحدى الدوائر.

تحدث قراءة خارج النطاق أثناء معالجة حمولة الخلية عندما تفتقر خلية END أو TRUNCATE أو TRUNCATED إلى سبب في حمولتها.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 86 Description: The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked, the browser incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. Recommendations: For versions prior to 86, update to version 86 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Measure function on the about:memory page until the update is applied.

The issue arises from the lifecycle of IPC Actors, where managed actors can outlive their manager actors. In such cases, the managed actors must ensure they do not attempt to use a dead actor they have a reference to. However, a check for this was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 81 Description: The issue is related to the processing of surfaces, where the lifetime may outlive a persistent buffer, leading to memory corruption and a potentially exploitable crash. It is also associated with a WebGL component vulnerability that involves copying a buffer without checking the size of the input data, potentially allowing a remote attacker to execute arbitrary code. Recommendations: For versions prior to 81, update to version 81 or later to resolve the issue. As a temporary workaround, consider disabling the WebGL component until a patch is available. Restrict access to potentially vulnerable web pages to minimize the risk of exploitation.

A use-after-free issue in the Quota manager can occur when removing data about an origin whose tab was recently closed, potentially leading to an exploitable crash. The issue is related to a memory management problem, where memory is accessed after it has been freed. This could allow a remote attacker to execute arbitrary code.

A cross-site scripting (XSS) issue exists in the View Filters page and Edit Filter page, allowing remote attackers to inject arbitrary code through a crafted PATH INFO, provided that the Content Security Policy (CSP) settings permit it.

The issue is related to a heap out-of-bounds read in the code handling the end-of-response for SMTP. This occurs when the buffer passed to `smtp endofresp()` is not null terminated and contains no character ending the parsed number, and `len` is set to 5. As a result, the `strtol()` call reads beyond the allocated buffer, but the read contents are not returned to the caller. The exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information, potentially leading to a denial of service.

A heap use-after-free flaw was found in the code related to closing an easy handle. When closing and cleaning up an 'easy' handle in the `Curl close()` function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

The issue is related to a heap-based buffer over-read in the `voutf()` function, which may result in information exposure and denial of service. This occurs due to flawed wrap logic when displaying warning and informational messages to stderr, causing the buffer arithmetic to calculate the remainder wrong and end up reading behind the end of the buffer. This could lead to information disclosure or crash, potentially resulting in a security issue if used in certain situations, such as a server using the curl command line to run something and showing stderr to the user, where user input can trigger the crash and disclose user memory contents.

The issue allows context-dependent attackers to cause a denial of service, resulting in a floating point exception and crash, via a crafted cert8.db file. This is due to a problem in the ` hash open` function in hash.c.

The issue arises when an IMAP FETCH response line indicates that the returned data is zero bytes. In this case, libcurl passes on the non-existing data with a pointer and the size (zero) to the deliver-data function. This function treats zero as a magic number and invokes strlen() on the data to figure out the length. However, the strlen() is called on a heap-based buffer that might not be zero-terminated, which can cause libcurl to read beyond the end of the buffer into adjacent memory or crash. As a result, libcurl may deliver the incorrectly read data to the application as if it were actually downloaded.

The issue is related to a buffer over-read in the PPP parser, specifically in the handle mlppp() function within print-ppp.c.

The issue is related to a buffer over-read in the DECnet parser. A remote attacker could obtain sensitive information by sending a specially crafted request to exploit this issue in the HNCP component.

A double free vulnerability exists in the zip dirent read function in zip dirent.c, which may allow attackers to have an unspecified impact. The vectors by which this issue can be exploited are unknown.