What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2022-12-22 22:15:16 | CVE-2022-43601 (lien direct) | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput Object can lead to a heap buffer overflow. An attacker can provide malicious input to trigger these vulnerabilities.This vulnerability arises when the `ymax` variable is set to 0xFFFF and `m_spec.format` is `TypeDesc::UINT16` | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41981 (lien direct) | A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bounds read and write on the process stack, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41794 (lien direct) | A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41837 (lien direct) | An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-crafted exif metadata can lead to stack-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41838 (lien direct) | A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41977 (lien direct) | An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:15 | CVE-2022-41988 (lien direct) | An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-crafted TIFF file can lead to a disclosure of sensitive information. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:14 | CVE-2022-41639 (lien direct) | A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-crafted TIFF file can lead to an out of bounds memory corruption, which can result in arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:14 | CVE-2022-41684 (lien direct) | A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A specially-crafted .psd file can cause a read of arbitrary memory address which can lead to denial of service. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:13 | CVE-2022-36354 (lien direct) | A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-length encoded byte spans are handled. A malformed RLA file can lead to an out-of-bounds read of heap metadata which can result in sensitive information leak. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:13 | CVE-2022-38143 (lien direct) | A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. | Vulnerability Guideline | ||
|
2022-12-22 22:15:12 | CVE-2022-22456 (lien direct) | IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 225004. | Vulnerability Guideline | ||
 |
2022-12-22 20:24:46 | Software bills of material face long road to adoption (lien direct) | >Most cybersecurity leaders want a standard recipe list for software, but implementing an effective compliance regime remains the challenge. | Guideline | ★ | |
|
2022-12-22 20:15:44 | CVE-2022-45415 (lien direct) | When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox < 107. | Vulnerability Guideline | ||
|
2022-12-22 20:15:42 | CVE-2022-45407 (lien direct) | If an attacker loaded a font using FontFace() on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox < 107. | Vulnerability Guideline | ||
|
2022-12-22 20:15:42 | CVE-2022-45409 (lien direct) | The garbage collector could have been aborted in several states and zones and GCRuntime::finishCollection may not have been called, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. | Vulnerability Guideline | ||
|
2022-12-22 20:15:42 | CVE-2022-45406 (lien direct) | If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. | Vulnerability Guideline | ||
|
2022-12-22 20:15:40 | CVE-2022-42928 (lien direct) | Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 102.4, Firefox ESR < 102.4, and Firefox < 106. | Vulnerability Guideline | ||
|
2022-12-22 20:15:39 | CVE-2022-40960 (lien direct) | Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. | Vulnerability Guideline | ||
|
2022-12-22 20:15:39 | CVE-2022-40961 (lien direct) | During startup, a graphics driver with an unexpected name could lead to a stack-buffer overflow causing a potentially exploitable crash. *This issue only affects Firefox for Android. Other operating systems are not affected.*. This vulnerability affects Firefox < 105. | Vulnerability Guideline | ||
|
2022-12-22 20:15:39 | CVE-2022-40959 (lien direct) | During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. | Vulnerability Guideline | ||
|
2022-12-22 20:15:39 | CVE-2022-40958 (lien direct) | By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. | Vulnerability Guideline | ||
|
2022-12-22 20:15:38 | CVE-2022-40957 (lien direct) | Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash. *This bug only affects Firefox on ARM64 platforms.*. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105. | Vulnerability Guideline | ||
|
2022-12-22 20:15:37 | CVE-2022-38476 (lien direct) | A data race could occur in the PK11_ChangePW function, potentially leading to a use-after-free vulnerability. In Firefox, this lock protected the data when a user changed their master password. This vulnerability affects Firefox ESR < 102.2 and Thunderbird < 102.2. | Vulnerability Guideline | ||
|
2022-12-22 20:15:35 | CVE-2022-36317 (lien direct) | When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanent Denial of Service. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 103. | Vulnerability Guideline | ||
|
2022-12-22 20:15:34 | CVE-2022-36314 (lien direct) | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the operating system. This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 102.1, Firefox < 103, and Thunderbird < 102.1. | Vulnerability Guideline | ||
|
2022-12-22 20:15:29 | CVE-2022-31741 (lien direct) | A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. | Vulnerability Guideline | ||
|
2022-12-22 20:15:28 | CVE-2022-31740 (lien direct) | On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. | Vulnerability Guideline | ||
|
2022-12-22 20:15:28 | CVE-2022-31737 (lien direct) | A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. | Vulnerability Guideline | ||
|
2022-12-22 20:15:28 | CVE-2022-31739 (lien direct) | When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. | Vulnerability Guideline | ||
|
2022-12-22 20:15:27 | CVE-2022-2226 (lien direct) | An OpenPGP digital signature includes information about the date when the signature was created. When displaying an email that contains a digital signature, the email's date will be shown. If the dates were different, then Thunderbird didn't report the email as having an invalid signature. If an attacker performed a replay attack, in which an old email with old contents are resent at a later time, it could lead the victim to believe that the statements in the email are current. Fixed versions of Thunderbird will require that the signature's date roughly matches the displayed date of the email. This vulnerability affects Thunderbird < 102 and Thunderbird < 91.11. | Vulnerability Guideline | ||
|
2022-12-22 20:15:27 | CVE-2022-2200 (lien direct) | If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. | Vulnerability Guideline | ||
|
2022-12-22 20:15:25 | CVE-2022-29911 (lien direct) | An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100. | Vulnerability Guideline | ||
|
2022-12-22 20:15:24 | CVE-2022-28287 (lien direct) | In unusual circumstances, selecting text could cause text selection caching to behave incorrectly, leading to a crash. This vulnerability affects Firefox < 99. | Vulnerability Guideline | ||
|
2022-12-22 20:15:23 | CVE-2022-28281 (lien direct) | If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. | Vulnerability Guideline | ||
|
2022-12-22 20:15:23 | CVE-2022-28282 (lien direct) | By using a link with rel="localization" a use-after-free could have been triggered by destroying an object during JavaScript execution and then referencing the object through a freed pointer, leading to a potential exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. | Vulnerability Guideline | ||
|
2022-12-22 20:15:22 | CVE-2022-26485 (lien direct) | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. | Vulnerability Guideline | ||
|
2022-12-22 20:15:22 | CVE-2022-26486 (lien direct) | An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0. | Vulnerability Guideline | ||
|
2022-12-22 20:15:21 | CVE-2022-26382 (lien direct) | While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page fonts. Side-channel attacks on the text by using specially crafted fonts could have lead to this text being inferred by the webpage. This vulnerability affects Firefox < 98. | Vulnerability Guideline | ||
|
2022-12-22 20:15:21 | CVE-2022-26384 (lien direct) | If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. | Vulnerability Guideline | ||
|
2022-12-22 20:15:20 | CVE-2022-26381 (lien direct) | An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7. | Vulnerability Guideline | ||
|
2022-12-22 20:15:16 | CVE-2022-22747 (lien direct) | After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:15 | CVE-2022-22744 (lien direct) | The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt. *This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:15 | CVE-2022-22746 (lien direct) | A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:14 | CVE-2022-22740 (lien direct) | Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:14 | CVE-2022-22742 (lien direct) | When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:14 | CVE-2022-22738 (lien direct) | Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:14 | CVE-2022-22737 (lien direct) | Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5. | Vulnerability Guideline | ||
|
2022-12-22 20:15:13 | CVE-2022-1529 (lien direct) | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. | Vulnerability Guideline | ||
|
2022-12-22 20:15:12 | CVE-2022-1196 (lien direct) | After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8. | Vulnerability Guideline |
To see everything:
Our RSS (filtrered)
