Yu Zhou

A vulnerability has been identified that allows an attacker to execute code in the context of the current process by exploiting an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This issue is related to a buffer overflow in memory, which can be triggered by a specially crafted PAR file, potentially enabling an attacker to execute arbitrary code.

A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted PSM files. This could allow an attacker to execute code in the context of the current process. The issue is related to a buffer overflow in memory, which can be exploited by using a specially crafted PSM file to execute arbitrary code.

The issue was addressed with improved memory handling. Processing a maliciously crafted gcx file may lead to unexpected app termination or arbitrary code execution.

A memory corruption issue was addressed with improved state management. Processing a maliciously crafted audio file may lead to arbitrary code execution.

A buffer overflow issue was addressed with improved bounds checking, which may result in arbitrary code execution.

An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted audio file may lead to arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 13.5 iPadOS versions prior to 13.5 macOS Catalina versions prior to 10.15.5 tvOS versions prior to 13.4.5 watchOS versions prior to 6.2.5 Description: The issue is related to an out-of-bounds read in the AudioToolbox library, which can be exploited by processing a maliciously crafted audio file, potentially leading to arbitrary code execution. This is a result of insufficient bounds checking, allowing an attacker to execute arbitrary code. Recommendations: For iOS versions prior to 13.5, update to iOS 13.5 or later. For iPadOS versions prior to 13.5, update to iPadOS 13.5 or later. For macOS Catalina versions prior to 10.15.5, update to macOS Catalina 10.15.5 or later. For tvOS versions prior to 13.4.5, update to tvOS 13.4.5 or later. For watchOS versions prior to 6.2.5, update to watchOS 6.2.5 or later. As a temporary workaround, consider avoiding the use of potentially malicious audio files until the issue is resolved.

The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code in the context of the current user, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue is related to multiple memory corruption problems that have been addressed through improved memory handling.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296, CVE-2018-8298.

An out-of-bounds read issue was addressed through improved input validation.

The issue is related to insufficient validation of untrusted input in PPAPI Plugins, which could allow a remote attacker to potentially gain privilege elevation. This can be achieved via a crafted HTML page.

The issue is related to insufficient input validation in the TIFFOpen function, which can be exploited by a remote attacker to cause a denial of service. A crafted input file can control the value of `td imagelength`, and setting this value close to the amount of system memory can cause the system to hang or trigger the OOM killer. The ChopUpSingleUncompressedStrip function calls ` TIFFCheckMalloc` based on `td imagelength`, leading to the denial of service.

The issue is related to insufficient validation of untrusted input in PPAPI Plugins, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could be achieved by exploiting the vulnerability in the PPAPI implementation.