Slonser

يوجد تجاوز سعة مخزن الـ«هيوب» (heap buffer) في ANGLE، وهي طبقة تجريد رسومية، داخل متصفح Google Chrome على نظام Mac. تتيح هذه المشكلة لمهاجم عن بُعد الوصول إلى الذاكرة خارج نطاقها عن طريق حث المتصفح على معالجة صفحة HTML مصممة خصيصًا لهذا الغرض.

توجد ثغرة قراءة خارج نطاق الذاكرة في ANGLE، وهي طبقة تجريد رسومية. يمكن للمهاجم عن بُعد الذي نجح بالفعل في اختراق عملية العرض استخدام صفحة HTML مصممة خصيصًا لقراءة معلومات قد تكون حساسة من ذاكرة العملية.

توجد مشكلة تسرب معلومات عبر قناة جانبية في مكون Scroll. تسمح هذه الثغرة لمهاجم عن بُعد بتسريب بيانات عبر الأصول (cross-origin)، وهي البيانات التي تنتمي إلى أصل مختلف عن الأصل الذي يقدم الصفحة الخبيثة، وذلك باستخدام صفحة HTML مصممة خصيصًا لهذا الغرض.

The issue is related to a spoofing vulnerability in Microsoft Exchange Server, which allows attackers to affect the system. This vulnerability can be exploited to conduct spoofing attacks, making an attacker's email address appear legitimate to the victim. The vulnerability is caused by the current implementation of the P2 FROM header verification. It is particularly useful for spear phishing and other forms of email-based deception. Over 1 million potential targets have been found.

The issue is related to the `readCodeFor` function in the mysql2 package, which is vulnerable to Remote Code Execution (RCE) due to improper validation of the `supportBigNumbers` and `bigNumberStrings` values. This allows a remote attacker to execute arbitrary code.

The issue is related to Improper Input Validation through the `keyFromFields` function, resulting in cache poisoning. An attacker can inject a colon `:` character within a value of the attacker-crafted key.

The issue allows for Information Exposure when the style attribute is permitted on the backend, enabling an attacker to enumerate files in the system, including project dependencies. This could be exploited to gather details about the file system structure and dependencies of the targeted server.

The issue is related to the ParseAddressList function, which incorrectly handles comments within display names. This can lead to different trust decisions being made by programs using different parsers, potentially allowing a remote attacker to perform spoofing attacks by providing specially crafted input data.

The issue is related to an inappropriate implementation in the Payments component of Google Chrome, allowing a remote attacker to bypass XSS preventions via a malicious file. This can enable the attacker to circumvent security restrictions and gain unauthorized access to protected information. The Chromium security severity of this issue is rated as High.