Nils Bars

A RegExp bailout processing issue allowed additional JavaScript execution, potentially triggering unexpected garbage collection.

A race during concurrent delazification could have led to a use-after-free. This issue affects several versions of Firefox and Thunderbird.

The issue arises when segmenting specially crafted text, leading to memory corruption and a potentially exploitable crash.

Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free.

The issue is related to a buffer overflow in memory when cloning certain objects, potentially leading to memory corruption. This could allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. It is currently unknown if this issue is exploitable.

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This issue may allow a remote attacker to execute arbitrary code.

The issue is related to a buffer overread vulnerability in the ngx http mp4 module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx http mp4 module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx http mp4 module.

The issue is related to incomplete WebAssembly exception handling, which could lead to a use-after-free. This allows an attacker to potentially execute arbitrary code. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to a type confusion in Async Generators, potentially leading to memory corruption and an exploitable crash. This could allow a remote attacker to cause a denial of service. The problem is associated with an error in the ECMA-262 specification.

The frame iterator could get stuck in a loop when encountering certain wasm frames, leading to incorrect stack traces.

The issue is related to the frame iterator component, which could get stuck in a loop when encountering certain wasm frames, leading to incorrect stack traces. This could allow a remote attacker to impact data integrity.

The issue is related to the use of memory after it has been freed in the HTTP/3 QUIC module (ngx http v3 module) of NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially allowing unauthorized access to protected information. The vulnerability is particularly relevant when the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, as undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

The issue is related to the HTTP/3 QUIC module in NGINX Plus and NGINX OSS. It involves undisclosed HTTP/3 encoder instructions that can cause NGINX worker processes to terminate or have other potential impacts. The vulnerability is also described as a buffer overflow in memory, which can be exploited by a remote attacker using specially crafted HTTP/3 requests to cause a denial of service.

The issue is related to a null pointer dereference in the HTTP/3 QUIC module (ngx http v3 module) of NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially leading to a denial of service. When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

The issue is related to a buffer overflow in the stack of the HTTP/3 QUIC module (ngx http v3 module) in NGINX Plus and NGINX OSS. This can be exploited by a remote attacker using specially crafted HTTP/3 requests, potentially causing denial of service or other impact. The attack requires specific timing during the connection draining process, which is difficult for the attacker to control.

The issue is related to a segmentation fault in dcmnet, a component of DCMTK, which occurs when an invalid DIMSE message is received.

The issue is related to a segmentation fault in the dcmdata component of the DCMTK library, which can be triggered by an invalid DIMSE message. This can potentially allow a remote attacker to cause a denial of service.

An issue in datafile.c allows an attacker to conduct a heap-based buffer overflow with an arbitrary amount of data in `df generate ascii array entry()`. This can be exploited by passing an overlong string as the right bound of the range argument to the `plot()` function.

A buffer overflow issue exists due to a missing size check of an argument passed to the `set font` function, specifically in the `cairotrm options` function when the Gnuplot pngcairo terminal is used as a backend. This allows an attacker to conduct a buffer overflow with an arbitrary amount of data.

An issue in Gnuplot allows an attacker to conduct a buffer overflow with an arbitrary amount of data in the `PS options` function. This flaw is caused by a missing size check of an argument passed to the `set font` function. The issue occurs when the Gnuplot postscript terminal is used as a backend.