Yangkang

The WebAudio `OscillatorNode` object in Mozilla Firefox was susceptible to a stack buffer overflow, potentially leading to a crash. This issue is related to a buffer overflow in memory, which could allow a remote attacker to cause a denial of service or execute arbitrary code.

The issue is related to a heap buffer overflow in the `nsWindow::PickerOpen(void)` method when running in headless mode. This could potentially allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

The issue is related to ownership mismanagement, leading to a use-after-free in `ReadableByteStreams`. This can be exploited by a remote attacker to execute arbitrary code.

The issue is related to the use of a MessagePort after it has been freed, potentially leading to an exploitable crash. This could allow a remote attacker to cause a denial of service or other impact. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to the use of memory after it has been freed, which can lead to a potentially exploitable crash. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with the creation of an `ImageBitmap` during process shutdown, which can later be used after being freed from a different code path.

The issue is related to arbitrary file uploads due to missing file type validation via the wp all import get gz.php file. This allows authenticated attackers with administrator level permissions and above to upload arbitrary files on the affected site's server, potentially making remote code execution possible.

The issue is related to operations on MessageTasks, where a task may be removed while still scheduled, leading to memory corruption and a potentially exploitable crash. This is also associated with a memory release error. Exploitation of this issue could allow a remote attacker to execute arbitrary code in the system.

The issue is related to a heap buffer overflow in the WebGL component of Google Chrome, which can be exploited by a remote attacker via a crafted HTML page. This could potentially lead to heap corruption, allowing the attacker to cause a denial of service or execute arbitrary code.

A memory corruption issue was addressed with improved state management. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

The issue is related to incorrect code generation management in the Windows Media Video Decoder component. It allows remote attackers to execute arbitrary code and affect the system.

Name of the Vulnerable Software and Affected Versions: Windows Media Video Decoder (affected versions not specified) Description: The issue is related to incorrect code generation management in the Windows Media Video Decoder component of Microsoft Windows operating systems. It allows remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue exists due to insufficient input validation in the Windows Media Foundation component of Windows operating systems. This allows remote attackers to execute arbitrary code and affect the system.

The issue exists due to insufficient input validation in the Windows GDI component, allowing a remote attacker to execute arbitrary code. This can enable the attacker to impact the system.

The issue is related to a component of the Windows operating system, specifically Windows GDI+, and is associated with shortcomings in security mechanisms. It may allow a remote attacker to gain unauthorized access to protected information. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to an information disclosure vulnerability in the Windows Graphics Component. It allows attackers to obtain sensitive information and potentially affect the system. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue exists due to insufficient input validation in the Microsoft DTV-DVD Video Decoder. This allows a remote attacker to execute arbitrary code.

Name of the Vulnerable Software and Affected Versions: Safari versions prior to 14.1 iOS versions prior to 12.5.3 iOS versions prior to 14.5 iPadOS versions prior to 14.5 watchOS versions prior to 7.4 tvOS versions prior to 14.5 macOS Big Sur versions prior to 11.3 Description: The issue is related to a use after free problem in the WebKit module, which can be exploited by a remote attacker using a specially crafted web page, potentially leading to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. Recommendations: For Safari version prior to 14.1, update to Safari 14.1 or later. For iOS version prior to 12.5.3, update to iOS 12.5.3 or later. For iOS version prior to 14.5, update to iOS 14.5 or later. For iPadOS version prior to 14.5, update to iPadOS 14.5 or later. For watchOS version prior to 7.4, update to watchOS 7.4 or later. For tvOS version prior to 14.5, update to tvOS 14.5 or later. For macOS Big Sur version prior to 11.3, update to macOS Big Sur 11.3 or later.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to errors in code generation management in the Windows GDI+ component, which can be exploited by remote attackers to execute arbitrary code and affect the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Windows Media Audio Decoder (affected versions not specified) Description: A remote code execution issue exists due to improper handling of objects by Windows Media Audio Decoder, allowing an attacker to potentially take control of an affected system. Exploitation could occur through various means, such as convincing a user to open a specially crafted document or visit a malicious webpage. The issue is related to errors in code generation control. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A remote code execution issue exists due to improper handling of objects by Windows Media Audio Codec, allowing an attacker to potentially take control of an affected system. Exploitation can occur through various means, such as convincing a user to open a specially crafted document or visit a malicious webpage. The security update corrects this by changing how the codec handles objects.