Marc Schoenefeld

O problema foi resolvido com verificações de limites aprimoradas. O processamento de uma imagem criada de forma maliciosa pode levar à execução arbitrária de código. O problema foi corrigido melhorando as verificações de limites e foi relatado por Mark Schenfeld, Ph.D.

Nome do software vulnerável e versões afetadas: Versões do Firefox anteriores à 133 Versões do Thunderbird anteriores à 133 Descrição: Pode ter ocorrido uma desreferência de ponteiro nulo na ferramenta `pk12util`, especificamente na função `SEC ASN1DecodeItem Util`, ao processar arquivos de entrada malformados ou formatados incorretamente. Esse problema pode permitir que um invasor remoto cause uma negação de serviço. Recomendações: Para versões do Firefox anteriores à 133, atualize para uma versão que inclua a correção para este problema. Para versões do Thunderbird anteriores à 133, atualize para uma versão que inclua a correção para este problema. Como solução temporária, considere restringir o uso da ferramenta `pk12util` e da função `SEC ASN1DecodeItem Util` até que um patch esteja disponível.

Um problema de uso após liberação de memória (use-after-free) foi corrigido com um gerenciamento de memória aprimorado. O processamento de um arquivo criado com intenção maliciosa pode levar ao encerramento inesperado do aplicativo ou à execução de código arbitrário. Esse problema afeta usuários do macOS Sonoma e Ventura.

Um problema de corrupção de memória foi corrigido com uma validação aprimorada. O processamento de uma imagem criada com intenção maliciosa pode levar à corrupção da pilha (heap).

The issue is related to a XSS vulnerability. It can be exploited via the `asset` parameter, specifically when using a `UUID` value.

The issue allows users to obtain unauthorized security information about private resources managed by JBoss ON.

The issue allows unsigned apps to read and write arbitrary files due to improper checking of property access.

The issue concerns the console in Apache jUDDI, which fails to properly escape line feeds. This allows remote authenticated users to spoof log entries by manipulating the `numRows` parameter.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted font file.

The issue allows remote authenticated users to execute arbitrary Java code. This can be achieved via either MVFLEX Expression Language (MVEL) or Drools expressions.

The issue is related to a use-after-free vulnerability that can be triggered by a crafted ICC profile file, potentially allowing remote attackers to cause a denial of service or execute arbitrary code.

The issue is related to the OpenGL implementation, which does not properly perform OpenGL Shading Language compilation. This allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted program.

The issue is related to the dexdump tool in the Android SDK, which does not properly perform structural verification. This allows user-assisted remote attackers to cause a denial of service, potentially leading to a crash, and possibly execute arbitrary code via a malformed APK or dex file. The attack vector involves a dex file that calls a method using more arguments than the number of registers declared for that method.

The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by using a document containing a crafted embedded TrueType font.

The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by providing a document containing a crafted SFNT table in an embedded font.

A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a document containing a crafted embedded OpenType font.

The issue is related to a heap-based buffer overflow in the wiretap/pcapng.c file, which can be triggered by a crafted capture file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

The issue allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of an inappropriate security descriptor in the JNLPClassLoader class.

The issue is related to multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to add and execute commands of their choice through the use of .. (dot dot) in the `site` parameter to (1) "index.php" and (2) "admin.php". Additionally, attackers can overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files. This could potentially allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service.

The issue is related to a heap-based buffer overflow in Impress, which can be triggered by a crafted PNG file in an ODF or Microsoft Office document. This can cause a denial of service, resulting in an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited by a remote attacker, potentially leading to unauthorized access to confidential data, disruption of service, or impact on data integrity.