Manfred Paul

تتعلق هذه الثغرة الأمنية بقراءة أو كتابة خارج النطاق (out-of-bounds) في كائن JavaScript عند الخلط بين أحجام مؤشرات المصفوفة. وقد يؤدي ذلك إلى تنفيذ تعليمات برمجية عشوائية. تمكن أحد المهاجمين من استغلال هذه الثغرة لكسب 50,000 دولار أمريكي في مسابقة Pwn2Own.

A type confusion issue exists within the WebAssembly module of the browser. This occurs because the WASM module decoder lacks a proper check of the type section size in a branch of the `DecodeTypeSection()` function. A remote attacker can exploit this by inducing the browser to load a specially crafted HTML page, which may lead to arbitrary code execution, denial of service, or information disclosure.

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. This issue affects Desktop Firefox only and does not affect mobile versions of Firefox. The vulnerability is related to incorrect event handling due to improper code generation management. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges and execute arbitrary code.

The issue is related to an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This can allow an attacker to read outside the expected values or execute arbitrary code remotely. The vulnerability is associated with the SpiderMonkey JIT Compiler.

An integer overflow was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution. A remote attacker may be able to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to an SQL Injection in ZoneMinder, a free, open source Closed-circuit television software application for Linux. The `minTime` and `maxTime` request parameters are not properly validated, allowing them to be used to execute arbitrary SQL.

The issue concerns a Local File Inclusion vulnerability via the "web/ajax/modal.php" endpoint, where an arbitrary php file path can be passed in the request and loaded.

توجد مشكلة في المصادقة غير الصحيحة حيث يمكن للمهاجم الذي لديه قدرة على القراءة والكتابة التعسفية تجاوز مصادقة المؤشر (Pointer Authentication)، وهي آلية أمنية تُستخدم لحماية سلامة المؤشرات في الذاكرة. تم استغلال هذه الثغرة بنشاط في الواقع لتسليم برمجيات خبيثة لسرقة المعلومات، خاصة باستهداف الأجهزة التي لم يتم تحديثها.

The issue allows UI spoofing when visiting a website that frames malicious content. This can lead to potential security risks.

The issue is related to incorrect input validation when handling JavaScript attributes, which could allow a remote attacker to execute arbitrary JavaScript code by corrupting an object prototype and setting undesired attributes on a JavaScript object, leading to privileged code execution.

The issue is related to errors in processing input data, which can lead to prototype pollution and allow an attacker to execute attacker-controlled JavaScript in the privileged parent process. This can occur when an attacker sends a message to the parent process, where the contents are used to double-index into a JavaScript object.

The issue is related to prototype pollution in the Array object in JavaScript, allowing an attacker to execute attacker-controlled JavaScript code in a privileged context. This can be achieved by corrupting the methods of an Array object. The estimated number of potentially affected devices is not provided.

The issue is related to a type confusion in the V8 JavaScript engine, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This can be achieved by exploiting errors in data type mixing.

The issue is related to a type confusion in the V8 JavaScript engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox. This can be achieved via a crafted HTML page.

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue is related to a buffer overflow in memory, allowing an attacker to execute arbitrary code in the context of the kernel.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of eBPF programs, resulting from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel.

The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing for arbitrary code execution. The problem is associated with accessing a resource through incompatible types.

The vulnerability is related to the bpf verifier in the Linux kernel, which did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This issue affects the Linux 5.4 stable series and newer versions. The vulnerability can be exploited to escalate privileges, allowing an attacker to gain root access. A working exploit exists but has not been publicly released. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, analyzing subsystems, and managing traffic within the kernel.

A flaw in the `.charkeys` procedure of ghostscript allows scripts to bypass `-dSAFER` restrictions by not properly securing its privileged calls. This enables an attacker to create a specially crafted PostScript file that could escalate privileges within Ghostscript, access files outside of restricted areas, or execute commands. The exploitation of this flaw may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.