Clément Lecigne

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 138.0.7204.157 Microsoft Edge versions prior to 138.0.3351.95 Opera versions prior to 120.0.5543.93 Opera GX versions prior to 120.0.5543.85 Opera Air versions prior to 120.0.5543.86 Apple Safari (via WebKit) versions prior to iOS 18.6 and macOS Sequoia 15.6 **Description** A high-severity vulnerability exists in the ANGLE and GPU components of Google Chrome and Chromium-based browsers. This flaw involves improper validation of untrusted input, potentially allowing a remote attacker to escape the browser's sandbox via a crafted HTML page. This could lead to remote code execution. The vulnerability is actively being exploited in the wild. Apple's Safari, which utilizes the WebKit engine, is also affected. **Recommendations** - Update Google Chrome to version 138.0.7204.157 or later. - Update Microsoft Edge to version 138.0.3351.95 or later. - Update Opera to version 120.0.5543.93 or later. - Update Opera GX to version 120.0.5543.85 or later. - Update Opera Air to version 120.0.5543.86 or later. - Update Apple iOS to version 18.6 or later. - Update Apple macOS to Sequoia 15.6 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 138.0.7204.96 **Description** A type confusion issue exists in the V8 JavaScript engine, which is used to execute web pages and applications. This flaw allows a remote attacker to perform arbitrary read and write operations by enticing a user to visit a specially crafted HTML page. Such memory manipulations can lead to remote code execution and are commonly used for sandbox escapes. There are reports of this issue being actively exploited in real-world attacks to execute arbitrary code and compromise systems. **Recommendations** Update Google Chrome to version 138.0.7204.96 or later.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 18.1.1 iOS versions prior to 17.7.2 and 18.1.1 iPadOS versions prior to 17.7.2 and 18.1.1 macOS Sequoia versions prior to 15.1.1 visionOS versions prior to 2.1.1 **Description** The issue was addressed with improved checks. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. **Recommendations** For Safari versions prior to 18.1.1, update to Safari 18.1.1. For iOS versions prior to 17.7.2 and 18.1.1, update to iOS 17.7.2 or 18.1.1. For iPadOS versions prior to 17.7.2 and 18.1.1, update to iPadOS 17.7.2 or 18.1.1. For macOS Sequoia versions prior to 15.1.1, update to macOS Sequoia 15.1.1. For visionOS versions prior to 2.1.1, update to visionOS 2.1.1.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 18.1.1 iOS versions prior to 17.7.2 and 18.1.1 iPadOS versions prior to 17.7.2 and 18.1.1 macOS Sequoia versions prior to 15.1.1 visionOS versions prior to 2.1.1 **Description** The issue is related to a cookie management problem that has been addressed with improved state management. Processing maliciously crafted web content may lead to a cross-site scripting attack. Apple is aware of a report that this issue may have been actively exploited on Intel-based Mac systems. **Recommendations** For Safari versions prior to 18.1.1, update to Safari 18.1.1 or later. For iOS versions prior to 17.7.2 and 18.1.1, update to iOS 17.7.2 or iOS 18.1.1 or later. For iPadOS versions prior to 17.7.2 and 18.1.1, update to iPadOS 17.7.2 or iPadOS 18.1.1 or later. For macOS Sequoia versions prior to 15.1.1, update to macOS Sequoia 15.1.1 or later. For visionOS versions prior to 2.1.1, update to visionOS 2.1.1 or later. As a temporary workaround, consider restricting access to malicious web content to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server versions prior to 10.5.29 Description: The issue concerns persistent and reflected XSS vulnerabilities in the `themeMode` cookie and ` h` URL parameter. This could allow attackers to execute arbitrary Javascript, potentially leading to session hijacking, data leakage, and further exploitation via a multi-stage attack. Recommendations: For Axigen Mail Server versions prior to 10.3.3.67, update to version 10.3.3.67 or later. For Axigen Mail Server versions 10.3.3.67 through 10.4.41, update to version 10.4.42 or later. For Axigen Mail Server versions 10.4.42 through 10.5.28, update to version 10.5.29 or later. As a temporary workaround, consider restricting access to the ` h` URL parameter and `themeMode` cookie to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Zimbra Collaboration Suite version 8.8.15 **Description** A reflected Cross-Site Scripting (XSS) issue has been identified, arising from improper handling of user-supplied input. This allows an attacker to inject malicious code that is reflected back in the HTML response, affecting one of the webmail calendar endpoints. The vulnerability may enable a remote attacker to conduct a cross-site scripting (XSS) attack, potentially leading to data theft or account takeover. **Recommendations** For Zimbra Collaboration Suite version 8.8.15, update the system to a patched version to mitigate the threats associated with this issue. As a temporary workaround, consider restricting access to the affected webmail calendar endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Axigen versions 10.0 through 10.3.3.61 **Description** The issue allows for cross-site scripting (XSS) via the image attachment viewer in WebMail. This could potentially affect a significant number of devices worldwide, although the exact number is not specified. **Recommendations** For versions 10.0 through 10.3.3.61, update to version 10.3.3.62 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 120.0.6099.129 **Description** A heap buffer overflow in WebRTC allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is actively exploited and may cause crashes or code execution. The issue is due to a heap buffer overflow weakness in the open-source WebRTC framework. **Recommendations** For Google Chrome versions prior to 120.0.6099.129, update to version 120.0.6099.129 or later to fix the heap buffer overflow vulnerability in WebRTC. As a temporary workaround, consider disabling WebRTC until a patch is available. Restrict access to WebRTC to minimize the risk of exploitation. Avoid using vulnerable WebRTC functions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 119.0.6045.199 **Description** The issue is related to an integer overflow in the Skia graphics library of Google Chrome, allowing a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a malicious file. The severity of this issue is high. It has been reported that an exploit for this issue exists in the wild and has been actively exploited by hackers. Google has released an emergency security update to address this zero-day vulnerability. **Recommendations** For Google Chrome versions prior to 119.0.6045.199, update to version 119.0.6045.199 or later to fix the integer overflow vulnerability in the Skia graphics library. As a temporary workaround, consider restricting access to potentially malicious files until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 117.0.5938.132 libvpx versions prior to 1.13.1 **Description** A heap buffer overflow vulnerability in the vp8 encoding in libvpx, a video codec library used by Google Chrome and other browsers, allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability is being actively exploited in the wild. Google has released a patch to address this issue. **Recommendations** For Google Chrome versions prior to 117.0.5938.132, update to version 117.0.5938.132 or later. For libvpx versions prior to 1.13.1, update to version 1.13.1 or later. As a temporary workaround, consider disabling the vp8 encoding feature in libvpx until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 125.0.6422.112 **Description** A type confusion issue exists in the V8 JavaScript engine. This flaw allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to visit a specially crafted HTML page. Type confusion occurs when a program accesses a resource using a different type than the one it was originally created with, leading to memory corruption or unexpected behavior. There are reports of this issue being exploited in the wild. **Recommendations** Update to version 125.0.6422.112 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 114.0.5735.110 **Description** The issue is related to a type confusion in V8, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code execution. The Chromium security severity of this issue is High. **Recommendations** For Google Chrome versions prior to 114.0.5735.110, update to version 114.0.5735.110 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable API endpoints or disabling the use of crafted HTML pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** watchOS versions prior to 9.5 tvOS versions prior to 16.5 macOS Ventura versions prior to 13.4 iOS versions prior to 15.7.8 and 16.5 iPadOS versions prior to 15.7.8 and 16.5 Safari versions prior to 16.5 **Description** The issue is related to a buffer overflow in the WebKit module, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted web page. This can allow the attacker to break out of the Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited. The issue was addressed with improved bounds checks. **Recommendations** For watchOS versions prior to 9.5, update to watchOS 9.5 or later. For tvOS versions prior to 16.5, update to tvOS 16.5 or later. For macOS Ventura versions prior to 13.4, update to macOS Ventura 13.4 or later. For iOS versions prior to 15.7.8 and 16.5, update to iOS 15.7.8, 16.5, or later. For iPadOS versions prior to 15.7.8 and 16.5, update to iPadOS 15.7.8, 16.5, or later. For Safari versions prior to 16.5, update to Safari 16.5 or later.

**Name of the Vulnerable Software and Affected Versions** Samsung Mobile Devices (affected versions not specified) **Description** The issue allows a privileged local attacker to bypass ASLR due to kernel pointers being printed in the log file prior to SMR May-2023 Release 1. This is related to the insertion of sensitive information into log files. There have been real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Telephony framework versions prior to SMR May-2023 Release 1 **Description** The issue is related to improper access control in the Telephony framework, allowing local attackers to modify call settings. **Recommendations** For versions prior to SMR May-2023 Release 1, update to the SMR May-2023 Release 1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 112.0.5615.137 **Description** The issue is caused by an integer overflow in the Skia library of Google Chrome, potentially allowing a remote attacker who has compromised the renderer process to perform a sandbox escape via a crafted HTML page. This could lead to remote code execution in an unprivileged app with no additional execution privileges needed, but user interaction is required for exploitation. The vulnerability has been exploited in the wild. **Recommendations** For Google Chrome versions prior to 112.0.5615.137, update to version 112.0.5615.137 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable `SkSLFunctionDefinition.cpp` functions until a patch is applied. Avoid using crafted HTML pages that could trigger the integer overflow in the Skia library.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 112.0.5615.121 **Description** The issue is related to a type confusion in V8, which can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This can lead to arbitrary code execution. The vulnerability is considered high severity by Chromium. There is evidence that this issue has been exploited in the wild. **Recommendations** For versions prior to 112.0.5615.121, update to version 112.0.5615.121 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable API endpoints until the update is applied. Avoid using crafted HTML pages that could exploit the type confusion in V8. At the moment, there is no additional information about other mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 16.4.1 iOS versions prior to 15.7.5 and prior to 16.4.1 iPadOS versions prior to 15.7.5 and prior to 16.4.1 macOS Ventura versions prior to 13.3.1 **Description** A use after free issue was addressed with improved memory management. This issue may lead to arbitrary code execution when processing maliciously crafted web content. Apple is aware of a report that this issue may have been actively exploited. **Recommendations** Update Safari to version 16.4.1 or later. Update iOS to version 15.7.5 or 16.4.1 or later. Update iPadOS to version 15.7.5 or 16.4.1 or later. Update macOS Ventura to version 13.3.1 or later. As a temporary workaround, consider restricting access to malicious web content to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 15.7.5 and 16.4.1 Apple iPadOS versions prior to 15.7.5 and 16.4.1 Apple macOS versions prior to 11.7.6, 12.6.5, and 13.3.1 **Description** An out-of-bounds write issue was addressed with improved input validation, allowing an app to potentially execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. **Recommendations** For Apple iOS versions prior to 15.7.5 and 16.4.1, update to iOS 15.7.5 or iOS 16.4.1. For Apple iPadOS versions prior to 15.7.5 and 16.4.1, update to iPadOS 15.7.5 or iPadOS 16.4.1. For Apple macOS versions prior to 11.7.6, update to macOS Big Sur 11.7.6. For Apple macOS versions prior to 12.6.5, update to macOS Monterey 12.6.5. For Apple macOS versions prior to 13.3.1, update to macOS Ventura 13.3.1.

**Name of the Vulnerable Software and Affected Versions** Safari versions prior to 16.2 tvOS versions prior to 16.2 macOS Ventura versions prior to 13.1 iOS versions prior to 15.7.2 and 16.1.2 iPadOS versions prior to 15.7.2 **Description** A type confusion issue was addressed with improved state handling. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1. The issue is related to the Apple Webkit browser mechanism and allows malicious web content to lead to remote code execution (RCE) on a vulnerable device. **Recommendations** For Safari versions prior to 16.2, update to Safari 16.2 or later. For tvOS versions prior to 16.2, update to tvOS 16.2 or later. For macOS Ventura versions prior to 13.1, update to macOS Ventura 13.1 or later. For iOS versions prior to 15.7.2 and 16.1.2, update to iOS 15.7.2, 16.1.2, or later. For iPadOS versions prior to 15.7.2, update to iPadOS 15.7.2 or later. As a temporary workaround, consider restricting access to malicious web content until the issue is resolved.