Clément Lecigne

توجد ثغرة أمنية شديدة الخطورة في مكونات ANGLE وGPU في Google Chrome والمتصفحات القائمة على Chromium. تتعلق هذه الثغرة بعدم التحقق بشكل كافٍ من صحة المدخلات غير الموثوقة، مما قد يسمح لمهاجم عن بُعد بالهروب من بيئة الحماية (sandbox) للمتصفح عبر صفحة HTML تم التلاعب بها. وقد يؤدي ذلك إلى تنفيذ التعليمات البرمجية عن بُعد. ويجري استغلال هذه الثغرة بشكل نشط في الواقع. كما أن متصفح Safari من Apple، الذي يستخدم محرك WebKit، متأثر أيضًا.

توجد مشكلة «خلط الأنواع» في محرك JavaScript V8، الذي يُستخدم لتنفيذ صفحات الويب والتطبيقات. تسمح هذه الثغرة لمهاجم عن بُعد بإجراء عمليات قراءة وكتابة تعسفية عن طريق إغراء المستخدم بزيارة صفحة HTML مصممة خصيصًا لهذا الغرض. يمكن أن تؤدي عمليات التلاعب بالذاكرة هذه إلى تنفيذ التعليمات البرمجية عن بُعد، وتُستخدم عادةً للهروب من بيئة الحماية (sandbox). وهناك تقارير تفيد باستغلال هذه المشكلة بشكل نشط في هجمات حقيقية لتنفيذ تعليمات برمجية تعسفية واختراق الأنظمة.

The issue was addressed with improved checks. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

The issue is related to a cookie management problem that has been addressed with improved state management. Processing maliciously crafted web content may lead to a cross-site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems.

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server versions prior to 10.5.29 Description: The issue concerns persistent and reflected XSS vulnerabilities in the `themeMode` cookie and ` h` URL parameter. This could allow attackers to execute arbitrary Javascript, potentially leading to session hijacking, data leakage, and further exploitation via a multi-stage attack. Recommendations: For Axigen Mail Server versions prior to 10.3.3.67, update to version 10.3.3.67 or later. For Axigen Mail Server versions 10.3.3.67 through 10.4.41, update to version 10.4.42 or later. For Axigen Mail Server versions 10.4.42 through 10.5.28, update to version 10.5.29 or later. As a temporary workaround, consider restricting access to the ` h` URL parameter and `themeMode` cookie to minimize the risk of exploitation.

A reflected Cross-Site Scripting (XSS) issue has been identified, arising from improper handling of user-supplied input. This allows an attacker to inject malicious code that is reflected back in the HTML response, affecting one of the webmail calendar endpoints. The vulnerability may enable a remote attacker to conduct a cross-site scripting (XSS) attack, potentially leading to data theft or account takeover.

The issue allows for cross-site scripting (XSS) via the image attachment viewer in WebMail. This could potentially affect a significant number of devices worldwide, although the exact number is not specified.

A heap buffer overflow in WebRTC allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is actively exploited and may cause crashes or code execution. The issue is due to a heap buffer overflow weakness in the open-source WebRTC framework.

The issue is related to an integer overflow in the Skia graphics library of Google Chrome, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a malicious file. The severity of this issue is high. It has been reported that an exploit for this issue exists in the wild and has been actively exploited by hackers. Google has released an emergency security update to address this zero-day vulnerability.

A heap buffer overflow vulnerability in the vp8 encoding in libvpx, a video codec library used by Google Chrome and other browsers, allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is being actively exploited in the wild. Google has released a patch to address this issue.

A type confusion issue exists in the V8 JavaScript engine. This flaw allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to visit a specially crafted HTML page. Type confusion occurs when a program accesses a resource using a different type than the one it was originally created with, leading to memory corruption or unexpected behavior. There are reports of this issue being exploited in the wild.

The issue is related to a type confusion in V8, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. The Chromium security severity of this issue is High.

The issue is related to a buffer overflow in the WebKit module, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted web page. This can allow the attacker to break out of the Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited. The issue was addressed with improved bounds checks.

The issue allows a privileged local attacker to bypass ASLR due to kernel pointers being printed in the log file prior to SMR May-2023 Release 1. This is related to the insertion of sensitive information into log files. There have been real-world incidents where this issue was exploited.

The issue is related to improper access control in the Telephony framework, allowing local attackers to modify call settings.

The issue is caused by an integer overflow in the Skia library of Google Chrome, potentially allowing a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. This could lead to remote code execution in an unprivileged app with no additional execution privileges needed, but user interaction is required for exploitation. The vulnerability has been exploited in the wild.

The issue is related to a type confusion in V8, which can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This can lead to arbitrary code execution. The vulnerability is considered high severity by Chromium. There is evidence that this issue has been exploited in the wild.

A use after free issue was addressed with improved memory management. This issue may lead to arbitrary code execution when processing maliciously crafted web content. Apple is aware of a report that this issue may have been actively exploited.

An out-of-bounds write issue was addressed with improved input validation, allowing an app to potentially execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

A type confusion issue was addressed with improved state handling. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1. The issue is related to the Apple Webkit browser mechanism and allows malicious web content to lead to remote code execution (RCE) on a vulnerable device.