727 matches found
CVE-2025-43529
CVE-2025-43529 TL; DR Apple recientemente lanzó iOS 26.2 y iPadOS 26.2, junto con un aviso de seguridad que incluye correcciones para vulnerabilidades de WebKit. Un error en el compilador JIT DFG CVE-2025-43529 destacó, así que decidí investigarlo. El compilador JIT reconoció correctamente que un...
uaf-2023-28205
CVE-2023-28205: Apple WebKit Use-After-Free Vulnerability This vulnerability affects Apple WebKit and can be exploited through maliciously crafted web content, potentially allowing arbitrary code execution in the context of the WebKit process. The affected WebKit build analyzed in this repository...
CVE-2024-2887-REPORT
SSD Advisory – Google Chrome RCE Fuente: ssd-disclosure.com/ssd-advisory-google-chrome-rce Resumen Una vulnerabilidad crítica de ejecución remota de código en Google Chrome versiones 123 y anteriores que afecta el manejo de tipos de recolección de basura garbage collection de WebAssembly WASM. El...
CVE-2024-44623
CVE-2024-44623 En SPX-GC 1.3.0v y versiones anteriores, la entrada controlada por el usuario se pasaba a la función exec del módulo childprocess sin ningún saneamiento, lo que conducía a una ejecución remota de código ciega no autenticada. Vulnerabilidad En /routes/routes-api.js, la entrada del...
CVE-2026-74936-gc-potato
CVE-2026-74936 A not fancy reproduction. The baseline required some fiddling here. Mozilla describes this issue as a WebAssembly use-after-free. Public fix 9823b5c86ffa keeps the exact trapping wasm::Code alive in JitActivation. The test performs a bad-signature cross-instance tail call. A Debugg...
CVE-2026-98050
The Linux kernel contains a vulnerability in the mlxsw: spectrum_ptp component where mlxsw_sp1_ptp_ht_gc_collect() calls napi_gro_receive() from a PTP garbage-collection workqueue instead of the NAPI poll context. This leads to a race condition because the call mutates the NAPI instance's GRO lis...
CVE-2026-98050
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...
Linux Distros Unpatched Vulnerability : CVE-2026-98050
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather...
CVE-2026-84118-who-labeled-the-crit-as-a-high
CVE-2026-84118 — SpiderMonkey GC use-after-free Bug 2057457 This is one of those where Mozilla labeled a Critical as a High. So someone might want to go have Firefox update the original bug hunters payment if that's the case. THE TLDR: You can do an OOB R primitive on a controlled pointer and the...
A-potential-Denial-of-Service-issue-in-protobuf-java
A-potential-Denial-of-Service-issue-in-protobuf-java A potential Denial of Service issue in protobuf-java high severity GitHub Reviewed Published 5 days ago in protocolbuffers/protobuf • Updated yesterday Vulnerability details Dependabot alerts 2 Package com.google.protobuf:protobuf-java maven...
CVE-2025-49844
CVE-2025-49844 – Redis Lua Parser Use-After-Free Lua chunk-name GC race leading to Redis 8.2.1 use-after-free and remote code execution. Overview Redis embeds Lua 5.1 for scripting. In versions up to 8.2.1 the luaYparser function does NOT anchor the chunk name string on the Lua stack before...
CVE-2026-84118
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript: GC component...
SUSE-SU-2026:23784-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.2.0 ESR MFSA 2026-85 bsc1278001: CVE-2026-75874 bmo2039972 Sandbox escape in the Remote Settings Client component CVE-2026-84118 bmo2057457 Use-after-free in the JavaScript: GC component CVE-2026-84119...
Astra Linux – Vulnerability in Firefox, Thunderbird
Failure to correctly record the location of live pointers across wasm instance calls resulted in a garbage collection occurring within the call without tracing those live pointers. This could have led to a use-after-free condition, causing a potentially exploitable crash. This vulnerability affec...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerabilities have been resolved: f2fs: fixed to avoid a use-after-free in f2fsstopgcthread. syzbot reports a f2fs bug as follows: dumpstack lib/dumpstack.c:88 inline dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 printreport+0xe8/0x550 mm/kasan/report.c:491...
Astra Linux – Vulnerability in Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: The commit mutex should not be released during the critical section between nftgcseqBegin and nftgcseqEnd. Otherwise, the async GC worker could collect expired objects and obtain the released commit lock with...
CVE-2026-80958
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...
EUVD-2026-76281
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cachereplay, the writeback worker and the GC worker bounds its length by PCACHESEGSIZE - segoff, the raw segment size rather than the data regio...
PT-2026-90088
In the Linux kernel, the following vulnerability has been resolved: dm-pcache: clamp the tail kset read to the segment data region The tail-kset read in cache replay, the writeback worker and the GC worker bounds its length by PCACHE SEG SIZE - seg off, the raw segment size rather than the data...
