Looben Yang

توجد مشكلة حرجة تتعلق بـ «الاستخدام بعد التحرير» (use-after-free) في مكون ServiceWorker في Chromium. قد تسمح هذه الثغرة لمهاجم عن بُعد باستغلال تلف الـ heap (heap corruption) من خلال صفحة HTML مصممة خصيصًا لهذا الغرض، مما قد يؤدي إلى تنفيذ تعليمات برمجية عشوائية أو رفض الخدمة. ترتبط هذه الثغرة بحالة تضارب بين معالجة مهلة الطلبات وبدء طلبات جديدة داخل ServiceWorker، مما يؤدي إلى حالة «استخدام بعد التحرير». اكتشف باحث هذه المشكلة وحصل على مكافأة قدرها 43,000 دولار من Google. لم ترد تقارير مؤكدة عن استغلال نشط لهذه الثغرة في الواقع. المكون `ServiceWorker` معرض لهذا الخلل.

The issue is related to a use-after-free vulnerability in the Scheduling component of Google Chrome and Microsoft Edge browsers. This vulnerability can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The Chromium security severity of this issue is High.

The issue is related to multiple race conditions in the font initialization, which could lead to memory corruption and execution of attacker-controlled code. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with concurrent execution using a shared resource with incorrect synchronization.

The issue is related to an out of bounds read in the Dawn component, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could lead to the disclosure of protected information. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to a use after free in WebGPU, which can potentially allow a remote attacker to exploit heap corruption via a crafted HTML page. This could enable the attacker to bypass existing security restrictions.

The issue is related to a type confusion in Blink, which can be exploited by a remote attacker via a crafted HTML page, potentially leading to heap corruption. This could allow the attacker to access confidential data, compromise data integrity, and cause a denial of service.

A race condition when running shutdown code for Web Worker led to a use-after-free issue, resulting in a potentially exploitable crash. This could allow a remote attacker to cause a denial of service.

The issue is related to the use of nested workers in browsers, which can lead to a use-after-free condition during worker destruction, resulting in a potentially exploitable crash. This could allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

The issue is related to memory safety bugs in Firefox, which can lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is caused by a buffer overflow in memory, allowing a remote attacker to potentially execute arbitrary code.

The issue is related to a use after free in Blink, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to a denial of service.

The issue is related to the early free of an object in use in IndexDB, which allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to arbitrary code execution. The vulnerability is associated with the use of memory after it has been freed, and exploitation may allow a remote attacker to execute arbitrary code using a specially crafted HTML page.

A use-after-free issue can occur during WebRTC connections when interacting with the DTMF timers, resulting in a potentially exploitable crash. The vulnerability is related to the implementation of WebRTC technology in Mozilla Firefox and Firefox-ESR browsers, allowing a remote attacker to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 58 Description: A use-after-free issue can occur when a Web Worker thread is freed from memory prematurely, instead of from the main thread memory, while cancelling fetch operations. This can potentially lead to a denial of service. The vulnerability is related to the implementation of the Web Worker mechanism in the browser, which can cause an out-of-bounds operation in memory. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue.

The issue is related to a use-after-free vulnerability in the implementation of WebSockets technology. This vulnerability can be exploited by a remote attacker to cause a denial of service, resulting in a crash. The vulnerability occurs when the object holding the connection is freed before the disconnection operation is finished.

A use-after-free issue can occur in the ANGLE graphics library, specifically within the `libGLES` component used for WebGL content on Windows. This happens when buffer storage is freed while still being used, potentially leading to a crash. Other operating systems are not affected.

A use after free issue in ANGLE allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. This could potentially be exploited by an attacker to access sensitive information.

A use after free issue in the webaudio component allows a remote attacker to perform an out of bounds memory read via a crafted HTML page, potentially giving access to protected information. This could enable remote attackers to view memory contents beyond boundaries using a specially formed HTML page.

The issue is related to a use-after-free vulnerability in the `CanonicalizeXPCOMParticipant` function. This vulnerability can be exploited by a remote attacker to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

The issue is related to a use-after-free vulnerability in the ServiceWorkerInfo class of the Service Worker subsystem. This vulnerability can be exploited by a remote attacker to execute arbitrary code via vectors related to the `BeginReading` method. The vulnerability is associated with the use of memory after it has been freed.

The issue is related to the ServiceWorkerManager class and can be exploited by remote attackers to execute arbitrary code or cause a denial of service, resulting in out-of-bounds read and memory corruption. This is achieved through unspecified use of the Clients API.