Zhiyi Zhang

The issue is related to a type confusion in the V8 JavaScript engine, which can be exploited by a remote attacker using a specially crafted HTML page, potentially leading to heap corruption or arbitrary code execution. The estimated severity of this issue is high. It has been reported that Google paid out $50,000 in bug bounties related to this and other vulnerabilities.

The issue is related to an integer overflow in the PDF viewer function, which could allow a remote attacker to exploit heap corruption via a crafted PDF file. This may impact the confidentiality, integrity, and availability of protected information.

The issue is related to errors in processing DNS requests. It allows a remote attacker to cause a denial of service using a specially crafted DNS request.

The issue is related to incorrect code generation management in the Windows DNS Server component, which can be exploited by a remote attacker to cause a denial of service. This can affect the system's operation.

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 10.15.6 Security Update versions prior to 2020-004 for Mojave and High Sierra Description: A local user may cause unexpected system termination or read kernel memory due to an out-of-bounds read issue, which has been addressed with improved input validation. Recommendations: For macOS versions prior to 10.15.6, update to macOS Catalina 10.15.6. For Mojave, apply Security Update 2020-004. For High Sierra, apply Security Update 2020-004.

The issue is related to a vulnerability in the Oracle WebLogic Server product, specifically in the Console component. This vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server, potentially resulting in a takeover. The vulnerability is easily exploitable and can impact the confidentiality, integrity, and availability of the server. It is associated with errors in code generation management and can be exploited using HTTP requests.

A memory corruption issue was addressed with improved memory handling, allowing an application to potentially execute arbitrary code with system privileges.

The issue is related to a remote code execution problem in the ChakraCore scripting engine, caused by a buffer overflow in memory. This could allow an attacker to execute arbitrary code with the same user rights as the current user by using a specially crafted web page. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view or modify data, or create new accounts with full user rights.

The issue is related to errors in handling objects in memory, specifically in the Internet Connection Sharing (ICS) function of the Windows operating system. This can allow a remote attacker to execute arbitrary code.

A buffer overflow issue was addressed through improved size validation, which could allow a malicious application to execute arbitrary code with kernel privileges.

The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. It could allow a remote attacker to execute arbitrary code using a specially crafted web page. The vulnerability can corrupt memory, enabling an attacker to gain the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.

The issue is related to the improper handling of objects in memory by the Windows kernel, which can lead to the disclosure of protected information. An attacker could exploit this by using a specially crafted application to reveal sensitive information.

The issue is related to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue is related to insufficient input validation in the WebKit display module. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information. Processing maliciously crafted web content may result in the disclosure of process memory.

An information disclosure issue exists due to improper memory handling by Chakra, potentially allowing an attacker to gain information that could further compromise a user's computer or data. To exploit this, an attacker must be aware of the memory address where an object was created. The issue is related to errors in handling internal data.

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.3 Description: The issue is related to insufficient access control in the WLS Core Components subcomponent of Oracle WebLogic Server, allowing an unauthenticated attacker with network access via the T3 protocol to compromise the server. Successful attacks can result in the takeover of Oracle WebLogic Server. Recommendations: For versions 10.3.6.0, 12.1.3.0, and 12.2.1.3, consider restricting access to the T3 protocol until a patch is available. As a temporary workaround, limit network access to the Oracle WebLogic Server to minimize the risk of exploitation. Avoid using the Oracle WebLogic Server for critical applications until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.