Marco Squarcina

تتعلق المشكلة بتنفيذ غير سليم في ”Custom Tabs“ (علامات التبويب المخصصة)، مما يسمح لمهاجم عن بُعد بتنفيذ تصعيد الصلاحيات عبر تطبيق تم التلاعب به، في حالة حث المستخدم على القيام بحركات معينة على واجهة المستخدم.

The issue is related to the incorrect handling of cookies by PHP applications, allowing network and same-site attackers to set a standard insecure cookie in the victim's browser, which is then treated as a Host- or Secure- cookie. This can potentially lead to session hijacking and unauthorized access to protected information.

The issue exists due to inadequate protection of web page structure when handling html and body tags. This could allow a remote attacker to gain unauthorized access to protected information. An attacker could use markup injection to steal nonce values, potentially bypassing strict content security policies.

A logic issue was addressed with improved state management. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

An injection issue was addressed with improved validation. A maliciously crafted webpage may be able to fingerprint the user. The issue is related to the disclosure of information and may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted webpage.

The issue is related to an inappropriate implementation in the Content Security Policy (CSP) mechanism of Google Chrome, allowing a remote attacker to bypass existing security restrictions using a specially crafted HTML page. This could potentially lead to security policy violations. The estimated number of affected devices and real-world incidents are not specified.

The issue is related to errors in state management due to an excessive number of cookies in `document.cookie`. This could allow a remote attacker to impact the integrity of protected information. When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with the expected cookie jar state, potentially causing requests to be sent with some cookies missing.

A logic issue was addressed with improved restrictions. Processing web content may lead to arbitrary code execution. This issue is caused by a buffer overflow in the web page display modules of WebKitGTK and WPE WebKit.

The issue is related to errors in the user interface's representation of information. It could allow a remote attacker to conduct spoofing attacks using a specially crafted cookie. When a secure cookie existed in the Firefox cookie jar, an insecure cookie for the same domain could have been created, leading to a desynchronization in expected results when reading from the secure cookie.

The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login but preserves the rest of session attributes, including CSRF tokens. This might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

The issue affects the passport package, causing the session to be regenerated instead of being closed when a user logs in or logs out.

The issue allows an unauthenticated attacker with logon to the infrastructure where Java SE, JRockit executes to compromise Java SE, JRockit. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products. The vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets, or by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.