Steven Michaud

A use-after-free issue exists in the Widget: Cocoa component. Use-after-free occurs when an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Certain canvas operations could have led to memory corruption.

The issue allows local users to obtain sensitive information by reading /tmp files, as demonstrated by credential information, due to the omission of a CoreGraphics disable-logging action needed by jemalloc-based applications.

The issue is related to a buffer overflow in the ATSFontDeactivate API within Apple Type Services (ATS) in Apple Mac OS X. This allows remote attackers to potentially execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors.

The issue arises from improper handling of certain redirections involving data: URLs and Java LiveConnect scripts. This allows remote attackers to start processes, read arbitrary local files, and establish network connections. The attack vector involves a refresh value in the http-equiv attribute of a META element, causing the wrong security principal to be used.

A use-after-free issue in the LiveConnect bridge code allows remote attackers to cause a denial of service, resulting in a crash, via unknown vectors.