Zhihua Yao

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 145.0.7632.159 **Description** An object lifecycle issue exists in PowerVR within Google Chrome on Android. This issue could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page. The security severity is critical. **Recommendations** Update Google Chrome to version 145.0.7632.159 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 103.0.5060.53 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free in the WebApp Provider, which could allow a remote attacker to potentially exploit heap corruption via specific UI interactions if the user is convinced to engage in specific user interactions. This could lead to unauthorized access to protected information. **Recommendations** For Google Chrome versions prior to 103.0.5060.53, update to version 103.0.5060.53 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** VP9 Video Extensions (affected versions not specified) **Description** The issue is related to incorrect code generation management in the VP9 Video Extensions package, which can lead to remote code execution. This could allow an attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 95.0.4638.54 **Description** The issue is related to the use of memory after it has been freed in the DevTools component of Google Chrome. This could allow a remote attacker to bypass existing security restrictions by using a specially crafted HTML page, potentially exploiting heap corruption. **Recommendations** For versions prior to 95.0.4638.54, update to version 95.0.4638.54 or later to resolve the issue. As a temporary workaround, consider restricting access to the DevTools component until a patch is applied. Avoid using specially crafted HTML pages that could exploit the heap corruption vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Media Foundation (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Media Foundation component of Windows operating systems. It allows remote attackers to execute arbitrary code and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Graphics Component (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Graphics Component of Windows operating systems. It allows a remote attacker to execute arbitrary code by sending a specially crafted request. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Raw Image Extension (affected versions not specified) Description: The issue is related to incorrect code generation management in the Raw Image Extension plugin. It can be exploited by an attacker to execute arbitrary code using a specially crafted malicious web page or a specially crafted malicious file. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows Graphics Component (affected versions not specified) **Description** The issue is related to incorrect code generation management in the Windows Graphics Component. It allows remote attackers to execute arbitrary code, affecting the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Graphics Component (affected versions not specified) **Description** The issue is related to the improper handling of objects in memory by the Microsoft Windows Graphics Component, which can lead to information disclosure. This could allow an attacker to obtain sensitive information. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** A remote code execution issue exists in Microsoft Excel software due to improper handling of objects in memory. This could allow an attacker to run arbitrary code in the context of the current user by using a specially crafted file. If the current user has administrative rights, the attacker could take control of the system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system may be less impacted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to the incorrect handling of objects in memory by the Graphics Device Interface (GDI) component in Windows operating systems. This can be exploited by an attacker to gain full control over the system or execute arbitrary code using a specially crafted document or web page. The vulnerability allows remote attackers to execute arbitrary code and affect the system. Exploitation can be achieved through two scenarios: via the web or through file shares. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to a component of the Windows operating system, specifically the Graphics Device Interface (GDI), which lacks protection of internal data. This can be exploited by an attacker using a specially crafted document or web page to gain unauthorized access to protected information. The exploitation may allow attackers to obtain sensitive information and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29 Description: The issue is related to a buffer over-read in the getsym function of the tekhex.c component in the BFD library, distributed in GNU Binutils. This allows remote attackers to cause a denial of service, resulting in a stack-based buffer over-read and application crash, via a malformed tekhex binary. The vulnerability is associated with reading beyond the permissible boundaries of a data buffer. Recommendations: For GNU Binutils version 2.29, consider applying a patch or fix that addresses the buffer over-read issue in the getsym function of the tekhex.c component to prevent a denial of service. As a temporary workaround, consider restricting the use of malformed tekhex binaries to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GNU Binutils version 2.29 **Description** The issue concerns a buffer overflow in the `elf read notes` function, located in `bfd/elf.c`, which can be triggered by a crafted binary file. This can lead to a denial of service, causing the application to crash. Additionally, it may have other unspecified impacts, potentially allowing remote attackers to access or modify confidential data. **Recommendations** For GNU Binutils version 2.29, consider disabling the `elf read notes` function as a temporary workaround until a patch is available. Restrict access to crafted binary files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.