Darknavy

قد تؤدي معالجة محتوى ويب مصمم بشكل خبيث إلى تعطل غير متوقع للعملية بسبب التعامل غير السليم مع الذاكرة.

تتعلق المشكلة بالتسجيل غير السليم في «تراستليت» التوقيع الرقمي، مما يسمح للمهاجمين المحليين ذوي الامتيازات بالحصول على `hmac key`. ويمكن للمهاجمين ذوي الامتيازات المحلية استغلال هذه الثغرة.

تتمثل الثغرة في قراءة خارج الحدود في «تراستليت» التوقيع الرقمي، مما يسمح للمهاجمين المحليين ذوي الصلاحيات بقراءة الذاكرة خارج الحدود.

تتعلق المشكلة بوجود ضوابط وصول غير كافية في «تراستليت» التوقيع الرقمي، مما يسمح للمهاجمين المحليين ذوي الامتيازات بالحصول على `auth token`. يمكن استغلال هذه الثغرة من قبل المهاجمين الذين يتمتعون بوصول وامتيازات محلية.

تتمثل المشكلة في حدوث كتابة خارج نطاق الذاكرة في trustlet Keymaster، مما يسمح للمهاجمين المحليين ذوي الصلاحيات العالية بالكتابة خارج نطاق الذاكرة. ويمكن للمهاجمين المحليين ذوي الصلاحيات العالية استغلال هذه الثغرة.

The issue is related to a configuration vulnerability in the OpenSSH service for Windows, specifically with the `-Oallow-remote-pkcs11` option for the ssh-agent cryptographic protection tool. This vulnerability is associated with incorrect external management of a file name or path, allowing a remote attacker to execute arbitrary code by loading a malicious DLL library. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to a use-after-free vulnerability in the Artificial Intelligence (AI) technology of Google Chrome and Microsoft Edge browsers. This vulnerability can be exploited by a remote attacker via a crafted HTML page, potentially allowing them to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with heap corruption.

The issue is related to out of bounds memory access in Compositing, allowing a remote attacker who has compromised the GPU process to potentially perform a sandbox escape via specific UI gestures. This could enable the attacker to execute arbitrary code using a specially crafted web page.

The issue is related to insufficient data validation in USB in Google Chrome, allowing a remote attacker to perform out of bounds memory access via a crafted HTML page. This could potentially enable the attacker to execute arbitrary code. The severity of this issue is considered high.

The issue is related to an integer overflow in the USB interface of Google Chrome, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to execute arbitrary code. The severity of this issue is classified as High by Chromium.

The issue is related to a use after free vulnerability in the Cast component of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page to potentially compromise the renderer process and exploit heap corruption.

The issue is related to an out of bounds memory access in the FedCM component of Google Chrome, allowing a remote attacker who has compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. This can potentially lead to the execution of arbitrary code. The severity of this issue is classified as High by Chromium security.