Sicks3C

Seroval allows for the stringification of JavaScript values, including complex structures. A flaw in the `fromJSON()` deserialization process allows a fulfilled Promise control node to pass a plugin-produced thenable (an object with a `then` method) to a native Promise resolver. This leads to the unexpected invocation of the callable during ECMAScript thenable assimilation, enabling attacker-controlled JSON to trigger code execution in applications using plugin-capable releases. This behavior bypasses previous type-confusion remediations because the invocation occurs during native Promise settlement after deserialization.

A heap-use-after-free issue exists in the `GetList()` method of PerlMagick. A heap-use-after-free occurs when an application continues to use a pointer after the memory it points to has been freed. A crafted call to the `GetList()` method can trigger this condition, leading to a crash and resulting in a denial of service.