Natashenka

Um problema de validação de entrada pode levar a uma negação de serviço ao processar uma mensagem criada com intenção maliciosa.

Um problema de leitura fora dos limites foi corrigido com a validação aprimorada de entradas. O processamento de vídeos maliciosos via FaceTime pode levar à execução de código arbitrário.

Um problema de validação de entrada pode permitir que um invasor remoto cause uma negação de serviço no sistema.

**Nome do software vulnerável e versões afetadas: Versões do Google Chrome anteriores à 84.0.4147.89 Descrição: O problema está relacionado a uma implementação inadequada no WebRTC, o que pode levar à corrupção da pilha (heap) por meio de um fluxo SCTP manipulado. Isso pode ser potencialmente explorado por um invasor em uma posição privilegiada na rede. A vulnerabilidade também está relacionada a um estouro de buffer na implementação do WebRTC, o que pode permitir que um invasor remoto comprometa a integridade dos dados. Recomendações: Para versões do Google Chrome anteriores à 84.0.4147.89, atualize para a versão 84.0.4147.89 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso à funcionalidade WebRTC até que a atualização seja aplicada.

A use after free issue was addressed with improved memory management. A remote attacker may be able to cause arbitrary code execution.

An out-of-bounds read issue was addressed with improved input validation, which may allow a remote attacker to cause unexpected application termination or arbitrary code execution.

A remote attacker may be able to leak memory due to this issue. The estimated number of potentially affected devices worldwide is not specified.

A use after free issue was addressed with improved memory management. A remote attacker may be able to cause arbitrary code execution.

An out-of-bounds read issue was addressed with improved input validation. The issue is related to remote iPhone exploitation via iMessage.

An input validation issue may lead to a denial of service when processing a maliciously crafted message.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1 Description: A memory corruption issue was addressed with improved input validation. Recommendations: For versions prior to 12.1, update to iOS 12.1 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 12.1 Description: A memory corruption issue was addressed with improved input validation. Recommendations: For versions prior to 12.1, update to iOS 12.1 or later to resolve the issue.

A buffer overflow issue was addressed with improved memory handling. A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code via a crafted web site. This is achieved by leveraging a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.

The issue involves the WebKit component and allows remote attackers to obtain sensitive credential information transmitted during a CSS mask-image fetch.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site that triggers an @generatorState use-after-free.

The issue allows remote attackers to cause a denial of service, resulting in memory corruption and SIGSEGV, via a crafted image file.

The issue allows remote attackers to cause a denial of service and execute arbitrary code via a crafted JPG. This can result in a segmentation fault and process crash.

The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. This is caused by a buffer overflow in memory.

The issue involves the `WebKit` component and allows remote attackers to execute arbitrary code via a crafted web site. It is related to the mishandling of strict mode functions and insufficient access control, which can be exploited to compromise information confidentiality.