Matt Giuca

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 45.0.2454.85 Opera versions prior to 45.0.2454.85 **Description** The issue concerns the UnescapeURLWithAdjustmentsImpl implementation in net/base/escape.cc, which does not prevent the display of Unicode LOCK characters in the omnibox. This makes it easier for remote attackers to spoof the SSL lock icon by placing one of these characters at the end of a URL, as demonstrated by the omnibox in localizations for right-to-left languages. **Recommendations** For Google Chrome versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue. For Opera versions prior to 45.0.2454.85, update to version 45.0.2454.85 or later to resolve the issue. As a temporary workaround, consider restricting the display of Unicode characters in the omnibox to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** python-cjson version 1.0.5 **Description** The issue is related to a buffer overflow that occurs when UCS-4 encoding is enabled. This allows attackers to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts. The attack vectors involve crafted Unicode input to the `cjson.encode` function. **Recommendations** For python-cjson version 1.0.5, consider disabling UCS-4 encoding as a temporary workaround to minimize the risk of exploitation. Avoid using the `cjson.encode` function with crafted Unicode input until the issue is resolved.