Zhenpeng Lin

A buffer overflow exists in Dawn, a WebGPU implementation, which allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page.

A type confusion issue exists in V8, the open-source JavaScript and WebAssembly engine. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the victim to visit a specially crafted HTML page. Real-world exploitation has been demonstrated using a chain of bugs to achieve a V8 sandbox escape and gain program counter control on arm64 architectures.

A type confusion issue exists in the V8 engine, which is the open-source JavaScript and WebAssembly engine used by Google Chrome. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the browser to process a specially crafted HTML page.

The `internal-sftp` component in `sshd` only recognizes the first 9 command-line arguments. This limitation may compromise security properties if critical configuration arguments are placed beyond the ninth position and are consequently ignored by the system.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A use-after-free issue existed in the V8 component of Google Chrome before version 147.0.7727.55. An attacker could potentially exploit heap corruption by convincing a user to install a malicious extension. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

An object lifecycle issue in the DevTools component of Google Chrome allowed an attacker to potentially exploit heap corruption. This exploitation could occur if a user was convinced to install a malicious extension. The security severity is rated as High.

A type confusion issue exists in the V8 component of Google Chrome. This could allow a remote attacker to exploit heap corruption through a specially crafted HTML page. The Chromium security severity is rated as High.

The issue is related to an error in resource management in the Linux kernel's route4 change function, which can be exploited to cause a denial of service or execute arbitrary code. The vulnerability is associated with a use-after-free problem in the cls route filter implementation. It allows a local privileged attacker to crash the system, potentially leading to a privilege escalation. The vulnerability can be exploited to elevate privileges by replacing non-privileged credentials with privileged ones.