Michal Zalewski

The issue involves the Safari component and allows remote attackers to spoof the address bar by leveraging text input during the loading of a page.

The issue allows for spoofing attacks by changing the addressbar to display a location that does not match the URL of the newly loaded page after dragging content from the primary browser pane to the addressbar on a malicious site.

The issue is caused by improper handling of invalid input, allowing context-dependent attackers to cause a denial of service via crafted XML data. This can lead to an out-of-bounds read and a crash in libxml2. The `xmlParseEntityDecl` and `xmlParseConditionalSections` functions in parser.c are affected.

The issue is related to a cross-site scripting (XSS) vulnerability in the Quick Look component. This vulnerability allows remote attackers to inject arbitrary web script or HTML via a previously visited web site that is rendered during a Quick Look search. The vulnerability exists due to insufficient protection of the web page structure.

The issue allows remote attackers to obtain sensitive information from process memory or cause a denial of service due to memory corruption via a crafted XML document. This is caused by a buffer overflow in the libxml2 component.

The issue is related to the ImageIO component in iOS and Mac OS X, which lacks protection of internal data. This can be exploited by a remote attacker using a specially crafted PNG file to access sensitive information in the process memory.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted TIFF image. This is caused by a buffer overflow in the ImageIO component.

The issue is related to the improper initialization of a data structure in the ImageIO component, allowing remote attackers to obtain sensitive information from process memory. This can be achieved by using a crafted TIFF image. The estimated number of potentially affected devices is not specified.

The issue is related to the improper implementation of the dequoting of collation-sequence names. This can be exploited by context-dependent attackers to cause a denial of service, resulting in uninitialized memory access and application crash, via a crafted COLLATE clause. For example, using `COLLATE""""""""` at the end of a SELECT statement can trigger this issue.

A use-after-free issue exists in the `ff h264 free tables` function, allowing remote attackers to potentially cause a denial of service or have other unspecified impacts through crafted H.264 data in an MP4 file. This can be demonstrated using an HTML VIDEO element referencing the malicious H.264 data.

The issue is related to the improper implementation of comparison operators in the sqlite3VdbeExec function, which can be exploited by context-dependent attackers. This can be achieved via a crafted CHECK clause, for example, CHECK(0&O>O) in a CREATE TABLE statement, potentially leading to a denial of service or other unspecified impacts.

The issue concerns the sqlite3VXPrintf function in printf.c, which does not properly handle precision and width values during floating-point conversions. This can be exploited by context-dependent attackers to cause a denial of service, specifically an integer overflow and stack-based buffer overflow, or possibly have other unspecified impacts. The attack can be carried out via large integers in a crafted printf function call in a SELECT statement.

The issue allows remote attackers to cause a denial of service due to uninitialized memory access via a crafted TIFF image.

The issue allows remote attackers to cause a denial of service due to uninitialized memory access via a crafted TIFF image. This is related to the `putcontig8bitYCbCr21tile` function in `tif getimage.c` or the `NeXTDecode` function in `tif next.c`.

The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read or write and crash. This occurs via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.

The issue allows remote attackers to cause a denial of service or possibly have other unspecified impacts via a crafted TIFF image. This is demonstrated by the failure of tif next.c to verify that the BitsPerSample value is 2, and the t2p sample lab signed to unsigned function in tiff2pdf.c.

The issue allows remote attackers to cause a denial of service, potentially leading to a crash, and may also enable the execution of arbitrary code. This can be triggered by a file containing a specific string, `{cb-999999999`.

The issue affects the PKCS#7 implementation in OpenSSL, allowing attackers to cause a denial of service (NULL pointer dereference and application crash) by providing malformed data with ASN.1 encoding. This can be exploited remotely. The vulnerability may lead to a disruption of confidentiality, integrity, and availability of protected information.

The issue is related to the PKCS7 dataDecode function in OpenSSL, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data. This is due to errors in pointer handling. The vulnerability can be exploited by an unauthenticated, remote attacker to cause a denial of service (DoS) condition or corrupt portions of OpenSSL process memory.

The issue is related to the handling of JPEG images, which can lead to the disclosure of sensitive information from uninitialized memory locations. This can be exploited remotely. The `get sos` function in `jdmarker.c` does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers. An information disclosure vulnerability exists within the open-source libjpeg image-processing library where it fails to properly handle objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass.