Steven Michaud

Um problema de use-after-free existe no componente Widget: Cocoa. O use-after-free ocorre quando uma aplicação continua a usar um ponteiro após ele ter sido liberado, o que pode levar a falhas no sistema ou execução de código arbitrário.

Determinadas operações de canvas poderiam ter levado à corrupção de memória.

The issue allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information, due to the omission of a CoreGraphics disable-logging action needed by jemalloc-based applications.

The issue is related to a buffer overflow in the ATSFontDeactivate API within Apple Type Services (ATS) in Apple Mac OS X. This allows remote attackers to potentially execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors.

The issue arises from improper handling of certain redirections involving data: URLs and Java LiveConnect scripts. This allows remote attackers to start processes, read arbitrary local files, and establish network connections. The attack vector involves a refresh value in the http-equiv attribute of a META element, causing the wrong security principal to be used.

A use-after-free issue in the LiveConnect bridge code allows remote attackers to cause a denial of service, resulting in a crash, via unknown vectors.