Miaubiz

The issue is related to an integer overflow in the FontData::Bound function in Google sfntly, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This can be achieved by providing a crafted offset or length value within font data in an SFNT container.

The issue is related to the HarfBuzzShaper.cpp file in Blink, which does not initialize a certain width field. This allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted Unicode text.

The issue arises from the incorrect handling of insufficient values in an feColorMatrix filter within the SVG implementation in Blink. This allows remote attackers to cause a denial of service, potentially leading to a container overflow, or possibly having other unspecified impacts through a crafted document.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. This is a different issue than other vulnerabilities listed in various Apple security updates.

A use-after-free issue in the RenderBlock::addChildIgnoringAnonymousColumnBlocks function in core/rendering/RenderBlock.cpp in Blink allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving addition of a child node. This issue can be exploited by adding a child node, which may lead to a denial of service or other unspecified effects on the system.

The issue is related to the SVG implementation in Blink. It allows remote attackers to cause a denial of service, specifically an out-of-bounds read, by leveraging the use of tree order rather than transitive dependency order for layout.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors in the SVG implementation. This is due to a problem in the core/rendering/svg/SVGInlineTextBox.cpp file.

The issue is related to a use-after-free vulnerability that can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This is achieved through vectors related to the handling of input.

A use-after-free issue in the SVG implementation allows remote attackers to cause a denial of service or possibly have other unspecified impacts via unknown vectors.

The issue allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, through vectors related to iTunes Store browsing.

A stack-based buffer overflow issue exists in the Canvas implementation, allowing remote attackers to execute arbitrary code via an HTML document with invalid width and height values.

A use-after-free issue allows remote attackers to execute arbitrary code via an HTML document. This issue affects Mac OS X systems.

The issue arises from the texImage2D implementation in the WebGL subsystem, which does not properly interact with Mesa drivers. This allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via function calls involving certain values of the `level` parameter.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via large image dimensions in the copyTexImage2D implementation in the WebGL subsystem.

The issue is caused by an integer overflow in the WebGL subsystem, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted data. This can result in an invalid write operation.

The issue is related to an integer overflow in the WebGL implementation, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. The attack vectors for this issue are unknown.

The issue is related to improper line breaking in crafted documents, allowing remote attackers to cause a denial of service through an out-of-bounds read.

A race condition exists due to improper interaction between worker processes and an XMLHttpRequest object, allowing remote attackers to cause a denial of service or possibly have other unspecified impacts.

The issue is related to the handling of run-in elements, where an unspecified variable is not properly cast, allowing remote attackers to cause a denial of service or possibly have other unknown impacts via a crafted document.