5540 matches found
Google Chrome 资源管理错误漏洞
Chrome is a web browsing tool developed by Google. a post-release reuse vulnerability exists in V8 in versions prior to Google Chrome 95.0.4638.54. An attacker could exploit the vulnerability to exploit heap corruption via a crafted HTML page...
PT-2021-4786
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 95.0.4638.69 Description The issue is related to type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker could potentially exploit this by using a specially crafted HTML...
DEBIAN-CVE-2021-37975
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
DEBIAN-CVE-2021-30632
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
UBUNTU-CVE-2021-30632
Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine arises due to an overflow in the buffer of dynamic memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a...
CVE-2021-37975
Use after free in V8 in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: gwillcox-r7 at October 02, 2021 7:38pm UTC reported: Exploitation in the wild of this bug has been noted as reported by Google ...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine, related to memory usage after deallocation, allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Google Emergency Update Fixes Two Chrome Zero Days
Google has pushed out an emergency Chrome update to fix yet another pair of zero days – the second pair this month – that are being exploited in the wild. This hoists this year’s total number of zero days found in the browser up to a dozen. “Google is aware the exploits for CVE-2021-37975 and...
serenity:FuzzJs: Use-after-poison in JS::Reference::put_value
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5600458299801600 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: Use-after-poison READ 8 Crash Address:...
Remote Code Execution (RCE)
Overview md-to-pdf is a CLI tool for converting Markdown files to PDF. Affected versions of this package are vulnerable to Remote Code Execution RCE due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine. PoC: bash //Before running poc.js: $ cat...
The vulnerability in the `lexer_parse_number` function of the `js-lexer.c` component of the JavaScript engine for Internet of Things applications, JerryScript, and the IoT.js platform, related to buffer overflows, allows attackers to access sensitive data, compromise its integrity, and cause service failures.
The vulnerability of the lexerparsenumber function in the js-lexer.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, is related to buffer overflow attacks. Exploiting this vulnerability could allow an attacker to gain access to confidential dat...
serenity:FuzzJs: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>void JS::VM::throw_exception<JS::RangeError> in JS::div
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5819009270939648 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffeb5cd4d78 Crash Stat...
Update now! Google Chrome fixes two in-the-wild zero-days
Google announced on Monday that it will be issuing patches for 11 high severity vulnerabilities found in Chrome, including two that are currently being exploited in the wild. The patch, which is part of the Stable Channel Update for Chrome 93 93.0.4577.82, will be released for Windows, Mac, and...
Google Chrome 缓冲区错误漏洞
Google Chrome is a web browser from Google, Inc. A code execution vulnerability exists in Google Chrome V8. A remote attacker could use this vulnerability to execute arbitrary code on the system or cause a denial of service condition...
serenity:FuzzJs: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=6083708214444032 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerasanserenity Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00050000002c Crash State: NULL Sanitizer: address ASAN Recommended...
CVE-2021-38493
Mozilla developers reported memory safety bugs present in Firefox 91 and Firefox ESR 78.13. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR 78.14,...
DEBIAN-CVE-2021-30598
Type confusion in V8 in Google Chrome prior to 92.0.4515.159 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...