CVE Vulnerability Catalog

Observable discrepancy in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially obtain cross-origin data via a crafted HTML page.

A use after free in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in Views in Google Chrome on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect reference resolution in the UI in Google Chrome on Android prior to 156.0.8078.73 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page.

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Paint component of Google Chrome prior to 156.0.8078.73. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

Type confusion in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

A use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

In a2aproject a2a-js up to 1.1.0, the ResultManager.applyStatusUpdate function in src/server/result_manager.ts is vulnerable to a race condition. The attack can be launched remotely, and the fix is included in version 1.2.0 (commit 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25).

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

In childTextNodesAreLiteral, tree walking stopped at the nearest foreign ancestor once an HTML integration point was found. Because that integration point may itself be a descendant of a foster-parented element in a foreign namespace, a parser may resolve the subtree in a different namespace upon re-parsing rendered output. The fix continues walking the full ancestor chain and verifies every namespace transition occurs at an HTML integration point.

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation reallocated and copied the accumulated string on every token. Inputs with many short text runs separated by ignored end tags caused O(n^2) allocations and byte copies. The fix accumulates coalesced text in per-node byte slices and materializes Data strings once at the end of parsing.

A type confusion vulnerability exists in Microsoft Edge (Chromium-based). An unauthorized attacker can exploit it to execute code over a network.

ast_loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs ast_loggrabber with elevated privileges.

app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The SMS dialplan application must be explicitly used and input not validated.