Rh0

توجد ثغرة أمنية تتعلق بتجاوز سعة المخزن المؤقت (buffer overflow) في عنصر التحكم ActiveX الخاص ببرنامج X360 VideoPlayer (`VideoPlayer.ocx`) عند معالجة معلمات طويلة بشكل مفرط للطريقة `ConvertFile()`. يمكن للمهاجم استغلال هذه الثغرة الأمنية عن طريق تزويد مدخلات مصممة خصيصًا لإحداث تلف في الذاكرة وتنفيذ تعليمات برمجية عشوائية في سياق العملية الحالية.

The issue allows attackers to cause a denial of service or possibly have other impact due to an out-of-bounds write. This is because the attacker controls the `pCreatePen->ihPen` array index in the `PlayEnhMetaFileRecord` function in `enhmetafile.c`.

The issue allows for a bypass of ASLR and DEP protections, potentially leading to memory corruption attacks. This is achieved through JIT-spray targeting asm.js combined with a heap spray.

The issue allows for a bypass of ASLR and DEP protections, potentially leading to memory corruption attacks. This is due to JIT code allocation.

The issue is related to a heap-based buffer overflow that can be triggered by foreign-context HTML5 fragments. This can be demonstrated by fragments within an SVG element, allowing remote attackers to execute arbitrary code.

The issue is a stack-based buffer overflow that allows remote attackers to execute arbitrary code. This is achieved by providing a long track name in an m3u playlist.

The issue is related to improper memory allocation in the browser engine, which can be exploited by remote attackers to cause a denial of service, resulting in memory corruption and application crash, or potentially execute arbitrary code.