Marc Schoenefeld

The issue was addressed with improved bounds checks. Processing a maliciously crafted image may lead to arbitrary code execution. The problem was fixed by improving bounds checks, and it was reported by Mark Schenfeld, Ph.D.

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Thunderbird versions prior to 133 Description: A null pointer dereference may have occurred in the `pk12util` tool, specifically in the `SEC ASN1DecodeItem Util` function, when handling malformed or improperly formatted input files. This issue can potentially allow a remote attacker to cause a denial of service. Recommendations: For Firefox versions prior to 133, update to a version that includes the fix for this issue. For Thunderbird versions prior to 133, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the `pk12util` tool and the `SEC ASN1DecodeItem Util` function until a patch is available.

A use-after-free issue was addressed with improved memory management. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. This issue affects macOS Sonoma and Ventura users.

A memory corruption issue was addressed with improved validation. Processing a maliciously crafted image may lead to heap corruption.

The issue is related to a XSS vulnerability. It can be exploited via the `asset` parameter, specifically when using a `UUID` value.

The issue allows users to obtain unauthorized security information about private resources managed by JBoss ON.

The issue allows unsigned apps to read and write arbitrary files due to improper checking of property access.

The issue concerns the console in Apache jUDDI, which fails to properly escape line feeds. This allows remote authenticated users to spoof log entries by manipulating the `numRows` parameter.

The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted font file.

The issue allows remote authenticated users to execute arbitrary Java code. This can be achieved via either MVFLEX Expression Language (MVEL) or Drools expressions.

The issue is related to a use-after-free vulnerability that can be triggered by a crafted ICC profile file, potentially allowing remote attackers to cause a denial of service or execute arbitrary code.

The issue is related to the OpenGL implementation, which does not properly perform OpenGL Shading Language compilation. This allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted program.

The issue is related to the dexdump tool in the Android SDK, which does not properly perform structural verification. This allows user-assisted remote attackers to cause a denial of service, potentially leading to a crash, and possibly execute arbitrary code via a malformed APK or dex file. The attack vector involves a dex file that calls a method using more arguments than the number of registers declared for that method.

The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by using a document containing a crafted embedded TrueType font.

The issue is related to multiple buffer overflows in Apple Type Services (ATS) that allow remote attackers to execute arbitrary code. This can be achieved by providing a document containing a crafted SFNT table in an embedded font.

A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a document containing a crafted embedded OpenType font.

The issue is related to a heap-based buffer overflow in the wiretap/pcapng.c file, which can be triggered by a crafted capture file. This can cause a denial of service, resulting in an application crash, or potentially allow the execution of arbitrary code.

The issue allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of an inappropriate security descriptor in the JNLPClassLoader class.

The issue is related to multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to add and execute commands of their choice through the use of .. (dot dot) in the `site` parameter to (1) "index.php" and (2) "admin.php". Additionally, attackers can overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files. This could potentially allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service.

The issue is related to a heap-based buffer overflow in Impress, which can be triggered by a crafted PNG file in an ODF or Microsoft Office document. This can cause a denial of service, resulting in an application crash, or possibly allow the execution of arbitrary code. The vulnerability can be exploited by a remote attacker, potentially leading to unauthorized access to confidential data, disruption of service, or impact on data integrity.