Igor Morgenstern

A flaw in the TTL file parser can lead to an infinite loop, resulting in a denial of service.

Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling.

An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. A use after free can lead to data corruption, crashes, or arbitrary code execution. The issue affects clients that use TLSA records with both PKIX-TA(0/PKIX-EE(1)) and DANE-TA(2) certificate usages. Clients that treat PKIX TLSA records as unusable or support only PKIX usages are not vulnerable. The client must also communicate with a server publishing a TLSA RRset with both types of TLSA records.

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.0 through 3.6 Description A NULL pointer dereference can occur during the processing of a delta CRL containing a Delta CRL Indicator extension if the required CRL Number extension is missing. This can lead to a denial of service. Exploitation requires the X509 V FLAG USE DELTAS flag to be enabled, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG FRESHEST flag set, and an attacker providing a malformed CRL. The issue is limited to denial of service and cannot be escalated to code execution or memory disclosure. Recommendations OpenSSL versions 3.0 through 3.6: Update to a newer version that contains a fix for this vulnerability.

The GNU C Library contains a flaw where calling `getnetbyaddr` or `getnetbyaddr r` with a configured `nsswitch.conf` that specifies the library's DNS backend for networks, and querying for a zero-valued network, can lead to the disclosure of stack contents to the configured DNS resolver. This can potentially bypass Address Space Layout Randomization (ASLR), leak credentials, expose cryptographic keys, and facilitate the exploitation of other memory corruption flaws. The issue stems from insufficient validation in the glibc DNS resolution functions, causing uninitialized stack memory to be transmitted to DNS resolvers. The functions `getnetbyaddr()` and `getnetbyaddr r()` are implicated in this information exposure.

Providing an excessively large alignment value to the `memalign` family of functions – including `memalign`, `posix memalign`, `aligned alloc`, `valloc`, and `pvalloc` – within the GNU C Library can lead to an integer overflow. This overflow may result in heap corruption.

The issue involves incorrect boundary conditions within the WebRTC Audio/Video component, leading to a heap overflow during H.264 decoding. This allows for attacker-controlled out-of-bounds read/write operations. The vulnerability exists in the WebRTC GMP H.264 decoding process, specifically triggered by short EncodedImage data.

A flaw exists in the JavaScript WebAssembly component of Firefox and Thunderbird due to incorrect boundary conditions, leading to a stack buffer overflow. This vulnerability could allow a remote attacker to execute arbitrary code via a malicious webpage. Approximately 180 million users may be affected. The issue is related to the WebAssembly garbage collection and involves faulty pointer math. Exploitation could lead to arbitrary code execution, session hijacking, or full system compromise.

A same-origin policy bypass exists within the Request Handling component. This allows potential circumvention of security restrictions designed to isolate different origins.

A use-after-free issue exists in the WebRTC: Signaling component of the software. This condition may lead to unexpected behavior or potentially allow for arbitrary code execution.