Wei Yuan

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 100.0.4896.60 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free vulnerability in the Shopping Cart component, which can be exploited by a remote attacker to potentially gain unauthorized access to protected information via a specially crafted web page. This can be achieved through standard user interaction, potentially leading to heap corruption. Google has released an update for Chrome that fixes 28 documented vulnerabilities, some of which are severe enough to lead to code execution attacks. The update, Chrome 100.0.4896.60, is available for Windows, Mac, and Linux users and addresses 9 high-severity issues, including use after free and buffer overflow errors. **Recommendations** For Google Chrome versions prior to 100.0.4896.60, update to Chrome 100.0.4896.60 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 95.0.4638.69 **Description** The issue is related to a use after free in the Sign-In component, which can be exploited by a remote attacker who convinces a user to sign into Chrome. This can potentially lead to heap corruption via a crafted HTML page. The attacker could execute arbitrary code or cause a denial of service using a specially crafted web page. **Recommendations** For Google Chrome versions prior to 95.0.4638.69, update to version 95.0.4638.69 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Sign-In feature until a patch is applied. Avoid using crafted HTML pages that could exploit the heap corruption vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 96.0.4664.93 **Description** The issue is related to a use after free in web apps, potentially allowing an attacker to exploit heap corruption. This could be achieved by convincing a user to install a malicious extension or by using a specially crafted web page, potentially enabling remote code execution. **Recommendations** For versions prior to 96.0.4664.93, update to version 96.0.4664.93 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11 Safari versions prior to 11 iCloud versions prior to 7.0 on Windows iTunes versions prior to 12.7 on Windows tvOS versions prior to 11 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11, update to version 11 or later. For Safari versions prior to 11, update to version 11 or later. For iCloud versions prior to 7.0 on Windows, update to version 7.0 or later. For iTunes versions prior to 12.7 on Windows, update to version 12.7 or later. For tvOS versions prior to 11, update to version 11 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11 Safari versions prior to 11 iCloud versions prior to 7.0 on Windows iTunes versions prior to 12.7 on Windows tvOS versions prior to 11 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11, update to version 11 or later. For Safari versions prior to 11, update to version 11 or later. For iCloud versions prior to 7.0 on Windows, update to version 7.0 or later. For iTunes versions prior to 12.7 on Windows, update to version 12.7 or later. For tvOS versions prior to 11, update to version 11 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 11 Apple Safari versions prior to 11 Apple iCloud versions prior to 7.0 on Windows Apple iTunes versions prior to 12.7 on Windows Apple tvOS versions prior to 11 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11, update to version 11 or later. For Safari versions prior to 11, update to version 11 or later. For iCloud versions prior to 7.0 on Windows, update to version 7.0 or later. For iTunes versions prior to 12.7 on Windows, update to version 12.7 or later. For tvOS versions prior to 11, update to version 11 or later.

**Name of the Vulnerable Software and Affected Versions** Apple iOS versions prior to 10.3.2 Apple Safari versions prior to 10.1.1 Apple iCloud versions prior to 6.2.1 on Windows Apple tvOS versions prior to 10.2.1 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 10.3.2, update to version 10.3.2 or later. For Safari versions prior to 10.1.1, update to version 10.1.1 or later. For iCloud versions prior to 6.2.1 on Windows, update to version 6.2.1 or later. For tvOS versions prior to 10.2.1, update to version 10.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 10.3 Safari versions prior to 10.1 tvOS versions prior to 10.2 **Description** The issue is caused by a buffer overflow in the WebKit component, allowing remote attackers to execute arbitrary code or cause a denial of service, such as memory corruption and application crash, via a specially crafted web site. **Recommendations** For iOS versions prior to 10.3, update to version 10.3 or later. For Safari versions prior to 10.1, update to version 10.1 or later. For tvOS versions prior to 10.2, update to version 10.2 or later.