Gary Kwong

A JIT miscompilation issue exists within the JIT component of the JavaScript Engine. JIT (Just-In-Time) compilation is a method used by the engine to improve performance by compiling code during execution rather than before.

An issue exists in the JavaScript Engine component.

A JIT miscompilation issue exists in the JavaScript: WebAssembly component. JIT (Just-In-Time) compilation is a method used by browsers to improve execution speed by compiling code during runtime. This flaw can lead to a sequence of failures including use-after-free, type confusion, memory leak, and arbitrary read/write, potentially resulting in remote code execution.

A race condition exists in the JavaScript: GC component. A race condition occurs when multiple threads access and manipulate shared data concurrently, leading to unpredictable behavior.

A use-after-free issue exists in the JavaScript Engine component. This can potentially allow for unexpected behavior or code execution.

A use-after-free issue exists in the JavaScript Engine component. This condition occurs when memory is accessed after it has been freed, potentially leading to crashes or arbitrary code execution.

The JavaScript Engine component contains a JIT miscompilation issue.

A use-after-free issue exists in the JavaScript: GC component. This can lead to potential security consequences.

A flaw exists due to improper state management. Processing specially designed web content can cause the application to crash unexpectedly.

A use-after-free issue exists due to improved memory management. Processing maliciously crafted web content may lead to an unexpected Safari crash. The issue involves Array allocation sinking in DFG.

An out-of-bounds access issue exists due to insufficient bounds checking when processing maliciously crafted web content. This may lead to an unexpected Safari crash.

On arm64 architecture, a WebAssembly (WASM) `br table` instruction with a large number of entries could result in the label being truncated due to its distance from the instruction. This truncation leads to an incorrect calculation of the branch address.

An out-of-bounds write issue exists in the WebKit rendering engine, where data is written outside the boundaries of the allocated memory buffer. This flaw allows maliciously crafted web content to break out of the Web Content sandbox, potentially enabling a remote attacker to execute arbitrary code. There are reports that this issue was exploited in highly sophisticated attacks targeting specific individuals on versions of iOS prior to iOS 17.2.

The software contains a flaw.

The issue is related to the processing of maliciously crafted web content, which may lead to memory corruption due to a buffer overflow in the Web Handler component. This can potentially allow a remote attacker to access confidential information. The problem was solved with improved memory handling.

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 18.2 iPadOS versions prior to 17.7.3 and prior to 18.2 watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 iOS versions prior to 18.2 Description: A type confusion issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to memory corruption. Recommendations: For Safari versions prior to 18.2, update to version 18.2 or later. For iPadOS versions prior to 17.7.3, update to version 17.7.3 or later. For iPadOS versions prior to 18.2, update to version 18.2 or later. For watchOS versions prior to 11.2, update to version 11.2 or later. For visionOS versions prior to 2.2, update to version 2.2 or later. For tvOS versions prior to 18.2, update to version 18.2 or later. For macOS Sequoia versions prior to 15.2, update to version 15.2 or later. For iOS versions prior to 18.2, update to version 18.2 or later.

The issue is related to an out-of-bounds access problem in the ICU component of the operating systems, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is caused by the processing of maliciously crafted web content, leading to an unexpected process crash.

A potential memory corruption issue could be triggered during JIT compilation if an attacker can cause an out-of-memory (OOM) condition at a specific moment. This may allow a remote attacker to cause a denial of service.

The issue arises from processing maliciously crafted web content, which may lead to an unexpected process crash.

A use-after-free issue could occur if a JavaScript realm was being initialized when a garbage collection started. This could potentially allow a remote attacker to execute arbitrary code. The vulnerability is related to the simultaneous loading of the global runtime environment and garbage collection.