Looben Yang

Existe um problema crítico de use-after-free no componente ServiceWorker do Chromium. Esta falha poderia permitir que um atacante remoto explorasse potencialmente a corrupção de heap por meio de uma página HTML especialmente criada, podendo levar à execução arbitrária de código ou negação de serviço. A vulnerabilidade está relacionada a uma condição de corrida entre o tratamento de timeouts de solicitação e o início de novas solicitações dentro do ServiceWorker, resultando em uma condição de use-after-free. Um pesquisador descobriu o problema e recebeu uma recompensa de $43.000 do Google. Não houve relatos confirmados de exploração ativa na natureza. O componente `ServiceWorker` é suscetível a esta falha.

O problema está relacionado a uma vulnerabilidade do tipo “use-after-free” no componente de agendamento dos navegadores Google Chrome e Microsoft Edge. Essa vulnerabilidade pode ser explorada por um invasor remoto para executar código arbitrário dentro de uma sandbox por meio de uma página HTML maliciosa. A gravidade de segurança do Chromium para este problema é Alta.

The issue is related to multiple race conditions in the font initialization, which could lead to memory corruption and execution of attacker-controlled code. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with concurrent execution using a shared resource with incorrect synchronization.

O problema está relacionado a uma leitura fora dos limites no componente Dawn, o que pode permitir que um invasor remoto explore uma corrupção de heap por meio de uma página HTML maliciosa. Isso poderia levar à divulgação de informações protegidas. O número estimado de dispositivos potencialmente afetados em todo o mundo não foi especificado.

O problema está relacionado a uma vulnerabilidade do tipo “use after free” no WebGPU, que pode permitir que um invasor remoto explore uma corrupção de heap por meio de uma página HTML maliciosa. Isso poderia permitir que o invasor contornasse as restrições de segurança existentes.

O problema está relacionado a uma confusão de tipos no Blink, que pode ser explorada por um invasor remoto por meio de uma página HTML maliciosa, podendo levar à corrupção da pilha (heap). Isso poderia permitir que o invasor acessasse dados confidenciais, comprometesse a integridade dos dados e causasse uma negação de serviço.

Uma condição de corrida ao executar o código de desligamento do Web Worker levou a um problema de uso após liberação de memória, resultando em uma falha potencialmente explorável. Isso poderia permitir que um invasor remoto causasse uma negação de serviço.

The issue is related to the use of nested workers in browsers, which can lead to a use-after-free condition during worker destruction, resulting in a potentially exploitable crash. This could allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

The issue is related to memory safety bugs in Firefox, which can lead to memory corruption. It is presumed that with sufficient effort, some of these bugs could be exploited to run arbitrary code. The vulnerability is caused by a buffer overflow in memory, allowing a remote attacker to potentially execute arbitrary code.

The issue is related to a use after free in Blink, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to a denial of service.

The issue is related to the early free of an object in use in IndexDB, which allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to arbitrary code execution. The vulnerability is associated with the use of memory after it has been freed, and exploitation may allow a remote attacker to execute arbitrary code using a specially crafted HTML page.

A use-after-free issue can occur during WebRTC connections when interacting with the DTMF timers, resulting in a potentially exploitable crash. The vulnerability is related to the implementation of WebRTC technology in Mozilla Firefox and Firefox-ESR browsers, allowing a remote attacker to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 58 Description: A use-after-free issue can occur when a Web Worker thread is freed from memory prematurely, instead of from the main thread memory, while cancelling fetch operations. This can potentially lead to a denial of service. The vulnerability is related to the implementation of the Web Worker mechanism in the browser, which can cause an out-of-bounds operation in memory. Recommendations: For versions prior to 58, update to version 58 or later to resolve the issue.

The issue is related to a use-after-free vulnerability in the implementation of WebSockets technology. This vulnerability can be exploited by a remote attacker to cause a denial of service, resulting in a crash. The vulnerability occurs when the object holding the connection is freed before the disconnection operation is finished.

A use-after-free issue can occur in the ANGLE graphics library, specifically within the `libGLES` component used for WebGL content on Windows. This happens when buffer storage is freed while still being used, potentially leading to a crash. Other operating systems are not affected.

A use after free issue in ANGLE allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. This could potentially be exploited by an attacker to access sensitive information.

A use after free issue in the webaudio component allows a remote attacker to perform an out of bounds memory read via a crafted HTML page, potentially giving access to protected information. This could enable remote attackers to view memory contents beyond boundaries using a specially formed HTML page.

The issue is related to a use-after-free vulnerability in the `CanonicalizeXPCOMParticipant` function. This vulnerability can be exploited by a remote attacker to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.

The issue is related to a use-after-free vulnerability in the ServiceWorkerInfo class of the Service Worker subsystem. This vulnerability can be exploited by a remote attacker to execute arbitrary code via vectors related to the `BeginReading` method. The vulnerability is associated with the use of memory after it has been freed.

The issue is related to the ServiceWorkerManager class and can be exploited by remote attackers to execute arbitrary code or cause a denial of service, resulting in out-of-bounds read and memory corruption. This is achieved through unspecified use of the Clients API.