Manfred Paul

The vulnerability is related to an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This could potentially result in the execution of arbitrary code. An attacker was able to exploit this issue to win $50,000 in a Pwn2Own competition.

A type confusion issue exists within the WebAssembly module of the browser. This occurs because the WASM module decoder lacks a proper check of the type section size in a branch of the `DecodeTypeSection()` function. A remote attacker can exploit this by inducing the browser to load a specially crafted HTML page, which may lead to arbitrary code execution, denial of service, or information disclosure.

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. This issue affects Desktop Firefox only and does not affect mobile versions of Firefox. The vulnerability is related to incorrect event handling due to improper code generation management. Exploitation of the vulnerability may allow a remote attacker to elevate their privileges and execute arbitrary code.

The issue is related to an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This can allow an attacker to read outside the expected values or execute arbitrary code remotely. The vulnerability is associated with the SpiderMonkey JIT Compiler.

An integer overflow was addressed with improved input validation. Processing maliciously crafted web content may lead to arbitrary code execution. A remote attacker may be able to access confidential data, compromise its integrity, and cause a denial of service.

The issue is related to an SQL Injection in ZoneMinder, a free, open source Closed-circuit television software application for Linux. The `minTime` and `maxTime` request parameters are not properly validated, allowing them to be used to execute arbitrary SQL.

The issue concerns a Local File Inclusion vulnerability via the "web/ajax/modal.php" endpoint, where an arbitrary php file path can be passed in the request and loaded.

An improper authentication issue exists where an attacker with arbitrary read and write capability may be able to bypass Pointer Authentication, a security mechanism used to protect the integrity of pointers in memory. This flaw has been actively exploited in the wild to deliver information-stealing malware, particularly targeting unpatched devices.

The issue allows UI spoofing when visiting a website that frames malicious content. This can lead to potential security risks.

The issue is related to incorrect input validation when handling JavaScript attributes, which could allow a remote attacker to execute arbitrary JavaScript code by corrupting an object prototype and setting undesired attributes on a JavaScript object, leading to privileged code execution.

The issue is related to errors in processing input data, which can lead to prototype pollution and allow an attacker to execute attacker-controlled JavaScript in the privileged parent process. This can occur when an attacker sends a message to the parent process, where the contents are used to double-index into a JavaScript object.

The issue is related to prototype pollution in the Array object in JavaScript, allowing an attacker to execute attacker-controlled JavaScript code in a privileged context. This can be achieved by corrupting the methods of an Array object. The estimated number of potentially affected devices is not provided.

The issue is related to a type confusion in the V8 JavaScript engine, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This can be achieved by exploiting errors in data type mixing.

The issue is related to a type confusion in the V8 JavaScript engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox. This can be achieved via a crafted HTML page.

The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue is related to a buffer overflow in memory, allowing an attacker to execute arbitrary code in the context of the kernel.

This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The specific flaw exists within the handling of eBPF programs, resulting from the lack of proper validation of user-supplied eBPF programs prior to executing them. An attacker can leverage this issue to escalate privileges and execute arbitrary code in the context of the kernel.

The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing for arbitrary code execution. The problem is associated with accessing a resource through incompatible types.

The vulnerability is related to the bpf verifier in the Linux kernel, which did not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This issue affects the Linux 5.4 stable series and newer versions. The vulnerability can be exploited to escalate privileges, allowing an attacker to gain root access. A working exploit exists but has not been publicly released. The vulnerability is present in the eBPF subsystem, which allows running handlers for tracing, analyzing subsystems, and managing traffic within the kernel.

A flaw in the `.charkeys` procedure of ghostscript allows scripts to bypass `-dSAFER` restrictions by not properly securing its privileged calls. This enables an attacker to create a specially crafted PostScript file that could escalate privileges within Ghostscript, access files outside of restricted areas, or execute commands. The exploitation of this flaw may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.