Marc Newlin

تحدث عملية قراءة خارج الحدود بسبب عدم كفاية التحقق من الحدود. تسمح هذه الثغرة لجهاز USB ضار بالتسبب في إنهاء غير متوقع للنظام أو قراءة ذاكرة النواة (kernel memory)، وهي منطقة الذاكرة الأساسية التي يستخدمها نظام التشغيل لإدارة الأجهزة والعمليات.

توجد مشكلة use-after-free ناتجة عن إدارة غير سليمة للذاكرة. يحدث هذا عندما يستمر البرنامج في استخدام مؤشر بعد تحريره، مما قد يؤدي إلى تلف ذاكرة النواة أو إنهاء النظام بشكل غير متوقع.

توجد مشكلة في فساد الذاكرة بسبب عدم كفاية التحقق من صحة المدخلات. قد يتمكن المهاجم الموجود على مقربة مادية من الجهاز من إفساد ذاكرة العملية.

A session management issue was addressed with improved checks. An attacker with physical access to the accessory may be able to extract its Bluetooth pairing key and monitor Bluetooth traffic. The issue is related to the management of user sessions and can be exploited to gain unauthorized access to Bluetooth traffic.

The issue is related to errors in the representation of information by the user interface in the Microsoft Bluetooth Driver. It allows a remote attacker to conduct spoofing attacks. The vulnerability can be exploited to pair a virtual Bluetooth keyboard without authentication or user confirmation.

A critical Bluetooth security flaw could be exploited by threat actors to take control of Android, Linux, macOS, and iOS devices. The issue relates to a case of authentication bypass that enables attackers to connect to susceptible devices and inject keystrokes to achieve code execution as the victim. This could lead to remote escalation of privilege with no additional execution privileges needed, and user interaction is not required for exploitation. The estimated number of potentially affected devices worldwide is not specified, but the flaw affects multiple operating systems, including Android, Linux, macOS, and iOS.

The issue allows keystroke injection, bypassing encryption, and is also known as MouseJack.

The issue allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.

The issue allows remote attackers to write arbitrary data to a known pathname, specifically /var/tmp/sess *, by leveraging the device's operation in UI dev mode.

The issue allows remote attackers to compute password-of-the-day values.

The issue allows remote attackers to discover a WAN IPv6 IP address by leveraging knowledge of the CM MAC address.

The issue allows remote attackers to access the web UI by establishing a session to the `wan0` WAN IPv6 address and then entering unspecified hardcoded credentials. This `wan0` interface cannot be accessed from the public Internet.

The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

The Comcast firmware on the affected devices does not set the secure flag for cookies in an https session to an administration application. This makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.

The issue concerns the absence of the HTTPOnly flag in a Set-Cookie header for administration applications. This omission makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.

The issue allows remote attackers to conduct successful forced-pairing attacks between an RF4CE remote and a set-top box by repeatedly transmitting the same pairing code.

The issue allows physically proximate attackers to read arbitrary files on the device. This can be achieved by pressing a specific sequence of buttons on an RF4CE remote to access the diagnostic display and then launching a Remote Web Inspector script.

The issue allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port and establishing communication with the device's link-local IPv6 address.

The issue allows physically proximate attackers to execute arbitrary commands as root. This can be achieved by accessing the diagnostics menu on the set-top box and then posting to a Web Inspector route.