Bruno Keith

The issue is related to insufficient validation of untrusted input in the V8 engine of Google Chrome, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized access to confidential information or cause a denial of service. The vulnerability has been reportedly exploited by actors such as Water Labbu in Electron-based applications, particularly targeting the financial industry.

The issue is related to a one-byte out of bounds read that could occur due to confusion when processing a hyphen character in Date.parse(), potentially leading to information disclosure. This is a result of a buffer overflow in memory, which could allow a remote attacker to gain unauthorized access to protected information.

A remote code execution issue exists due to the way Microsoft browsers access objects in memory. This could allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative rights, the attacker could gain control of the system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue is related to errors in handling objects in memory by the ChakraCore scripting engine. This could allow a remote attacker to execute arbitrary code, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue exists due to errors in handling objects in memory by the ChakraCore JavaScript engine. This could allow a remote attacker to execute arbitrary code, potentially gaining the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. The vulnerability is related to reading data beyond buffer memory boundaries, which may allow a remote attacker to gain unauthorized access to protected data.

An out-of-bounds read issue was addressed with improved bounds checking.

A memory corruption issue was addressed with improved memory handling.

The issue is related to the JavaScript JIT compiler inlining Array.prototype.push with multiple arguments, resulting in the stack pointer being off by 8 bytes after a bailout. This can leak a memory address to the calling function, potentially used as part of an exploit inside the sandboxed content process. The vulnerability is also described as being related to insufficient input validation in the implementation of the Array.prototype.push method in Firefox and Firefox ESR browsers, which could allow a remote attacker to execute arbitrary code.

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. The issue is related to errors in data type conversion.

The issue is related to a remote code execution problem in the Chakra scripting engine, which can lead to memory corruption. This allows an attacker to execute arbitrary code in the context of the current user by using a specially crafted web page. If the current user has administrative rights, the attacker could gain control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.