Junyoung Park

JIT miscompilation occurs in the JavaScript: WebAssembly component. Just-In-Time (JIT) compilation is a method used to improve the execution speed of programs by compiling code during runtime rather than before execution.

Out of bounds memory access in V8 allows a remote attacker to execute arbitrary code inside a sandbox by using a crafted HTML page.

An out of bounds read in V8 allows a remote attacker to obtain potentially sensitive information from process memory by using a crafted HTML page. An out of bounds read occurs when the system reads data past the end or before the beginning of the intended buffer.

An integer overflow in the V8 JavaScript engine within Google Chrome could lead to heap corruption. This issue could be triggered by a remote attacker using a specially crafted HTML page. The Chromium security severity is rated as High.

The NVIDIA Installer for NvAPP for Windows has a flaw in the FrameviewSDK installation process. An attacker with local unprivileged access can alter files within the Frameview SDK directory. A successful exploit could result in privilege escalation.

The issue concerns the behavior of `os.OpenFile` when the target path is a dangling symlink. On Unix systems, `os.OpenFile` with `O CREATE` and `O EXCL` flags never follows symlinks. However, on Windows, if the target path was a symlink to a nonexistent location, `os.OpenFile` would create a file in that location. This discrepancy has been addressed, and now `os.OpenFile` always returns an error when the `O CREATE` and `O EXCL` flags are both set and the target path is a symlink.

The issue is related to a wrong lowering instruction in the ARM64 Ion compiler, resulting in incorrect optimization. This can allow a remote attacker to gain unauthorized access to protected information. The vulnerability may enable the attacker to access confidential information.

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.1.1 through 12.1.3 Description: The issue is related to errors in the code of the User Interface component of the Oracle Labor Distribution product. It allows a low-privileged attacker with network access via HTTP to compromise Oracle Labor Distribution, resulting in unauthorized creation, deletion, or modification access to critical data or all accessible data, as well as unauthorized access to critical data or complete access to all accessible data. Recommendations: For versions 12.1.1 through 12.1.3, consider restricting access to the User Interface component until a patch is available. As a temporary workaround, limit the use of HTTP requests to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.20 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. The vulnerability may significantly impact additional products. Recommendations: For versions prior to 6.1.20, update to version 6.1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.18 Description: The issue is related to insufficient input validation in the Core component of Oracle VM VirtualBox, allowing a high-privileged attacker with logon to the infrastructure to compromise Oracle VM VirtualBox. Successful attacks can result in unauthorized ability to cause a hang or frequently repeatable crash of Oracle VM VirtualBox. Recommendations: For versions prior to 6.1.18, update to version 6.1.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the Core component of Oracle VM VirtualBox to minimize the risk of exploitation.

The issue is related to the use of non-TLS based encryption in the CmpUserMgr component of CODESYS V3 products, which results in user credentials being insufficiently protected during transport. This could allow a remote attacker to gain unauthorized access to protected information. Authentication is needed for exploitation, but there are cases where this requirement could be bypassed.