Samuel Groß

The issue is related to cross-compartment wrappers wrapping a scripted proxy, which could cause objects from other compartments to be stored in the main compartment, resulting in a use-after-free after unwrapping the proxy. This can be exploited by a remote attacker to store objects from other compartments in the main compartment.

A memory corruption issue was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution.

The issue is related to the use of memory after it has been freed when processing JavaScript code, potentially leading to a crash that could be exploited by a remote attacker. This could occur if an out-of-memory condition happens when creating a JavaScript global, causing a JavaScript realm to be deleted while references to it still exist in a BaseShape, resulting in a use-after-free situation.

The issue is related to the Garbage Collector component of the JS Engine in Mozilla browsers, which incorrectly releases memory segments. This can be exploited by a remote attacker using a specially crafted malicious website, potentially allowing the execution of arbitrary code or causing a denial of service. The vulnerability is associated with missing annotations in certain types of allocations, which could lead to memory corruption and a potentially exploitable crash if the Garbage Collector is in a specific state.

The issue is related to a memory corruption problem that can be exploited by processing maliciously crafted web content, potentially leading to arbitrary code execution. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

A memory corruption issue was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution. The issue is related to a buffer overflow vulnerability in the WebKitGTK and WPE WebKit modules, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

A race condition was addressed with additional validation. This issue allows an application to potentially gain elevated privileges.

Multiple security issues were discovered in Chromium, potentially leading to arbitrary code execution, denial of service, or information disclosure. A heap corruption issue in the V8 JavaScript and WebAssembly engine, present in versions prior to 95.0.4638.69, could be exploited through a crafted HTML page. In some instances, malicious mods were distributed for the game Dota 2 via the Steam store, containing backdoors and exploiting the Chrome vulnerability CVE-2021-38003. These mods included `Overdog no annoying heroes`, `Custom Hero Brawl`, and `Overthrow RTZ Edition X10 XP`. The malicious code within these mods could be used for logging, executing system commands, creating coroutines, and sending HTTP GET requests. Security support for Chromium has been discontinued for the 'buster' distribution due to toolchain limitations. The `evil.lua` file was used to test server-side Lua execution capabilities.

The issue is caused by a race condition in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page, allowing them to bypass existing security restrictions. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

A memory corruption issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to code execution.

An out-of-bounds read issue was addressed with improved input validation. Processing a maliciously crafted image may lead to arbitrary code execution.

The issue is related to authentication errors in the operating systems and services of Apple devices. A malicious attacker with arbitrary read and write capability may be able to bypass Pointer Authentication, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

A logic issue was addressed with improved validation, allowing an attacker with memory write capability to potentially bypass pointer authentication codes and run arbitrary code.

A logic flaw exists within the WebKit engine, potentially allowing a remote attacker to execute arbitrary code by processing maliciously crafted web content. This issue affects multiple Apple products, including macOS, tvOS, watchOS, Safari, iTunes, and iCloud for Windows. The vulnerability is related to improper restrictions and can be exploited through specially designed web pages. The issue has been actively exploited. The vulnerability affects WebKitGTK and WPE WebKit, potentially leading to cross-site scripting, denial of service, and arbitrary code execution.

The issue is related to an out-of-bounds read during RLE uncompression in the `rleUncompress` function in `ImfRle.cpp`. This can potentially allow a remote attacker to cause a denial of service.

An issue in OpenEXR is related to an out-of-bounds read in ImfOptimizedPixelReading.h. This can potentially allow a remote attacker to cause a denial of service by exploiting the vulnerability.

An issue in OpenEXR is related to an out-of-bounds write in the `copyIntoFrameBuffer` function in `ImfMisc.cpp`. This can potentially allow a remote attacker to cause a denial of service.

The issue is related to integer overflows in `CompositeDeepScanLine::Data::handleDeepFrameBuffer` and `readSampleCountForLineBlock` functions, allowing an attacker to write to an out-of-bounds pointer. This can lead to a denial of service. The vulnerability can be exploited by a remote attacker.

The issue is related to an out-of-bounds read during Huffman uncompression. This can be demonstrated by the `FastHufDecoder::refill` function in `ImfFastHuf.cpp`. The exploitation of this issue may allow a remote attacker to cause a denial of service.

The issue is related to an out-of-bounds read and write in the `DwaCompressor::uncompress` function in `ImfDwaCompressor.cpp` when handling the UNKNOWN compression case. This can be exploited by a remote attacker to cause a denial of service.