2611 matches found
CVE-2018-16083
Removed by vendor...
CVE-2018-16071
CVE-2018-16071 is a use-after-free in WebRTC processing (VP9) within Google Chrome’s WebRTC stack. The vulnerability arises when an untrusted index extracted from an RTP packet is used as the upper bound for vector erase, potentially dereferencing memory beyond the allocated range and causing hea...
CVE-2018-16083
CVE-2018-16083: Out-of-bounds read in WebRTC FEC within Google Chrome’s WebRTC stack. A crafted HTML page could trigger an out-of-bounds memory read via RTP/FEC processing, allowing remote data exposure. The vulnerability affects Chrome versions prior to 69.0.3497.81; remediation is to update Chr...
Adventures in Video Conferencing Part 5: Where Do We Go from Here?
Posted by Natalie Silvanovich, Project Zero Overall, our video conferencing research found a total of 11 bugs in WebRTC, FaceTime and WhatsApp. The majority of these were found through less than 15 minutes of mutation fuzzing RTP. We were surprised to find remote bugs so easily in code that is so...
Adventures in Video Conferencing Part 1: The Wild World of WebRTC
Posted by Natalie Silvanovich, Project Zero Over the past five years, video conferencing support in websites and applications has exploded. Facebook, WhatsApp, FaceTime and Signal are just a few of the many ways that users can make audio and video calls across networks. While a lot of research ha...
How to tighten security and increase privacy on your browser
Is my browser making an effort to keep my system safe and my online behavior private? This is usually not the first question we ask ourselves when we choose our default browser. But maybe it should be. These days, threats to your privacy and security come at your from all angles, but browser-base...
WebRTC Use After Free Code Execution (CVE-2018-16071)
A use-after-free vulnerability exists in WebRTC. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
WebRTC FEC Out Of Bounds Read (CVE-2018-16083)
A out of bounds read vulnerability exists in WebRTC. Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information...
Security update for seamonkey (important)
This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998: CVE-2018-12359: Buffer overflow using computed size of canvas element CVE-2018-12360: Use-after-free when using...
WebRTC - FEC Out-of-Bounds Read Exploit
Exploit for multiple platform in category dos / poc There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR:...
WebRTC - VP9 Processing Use-After-Free Exploit
Exploit for multiple platform in category dos / poc There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx...
WebRTC - VP9 Processing Use-After-Free
WebRTC - VP9 Processing Use-After-Free There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx; ... // snip...
WebRTC - FEC Out-of-Bounds Read
There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer: heap-buffer-overflow on address...
WebRTC - VP9 Processing Use-After-Free
There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx; ... // snip info = &gofinfoit-second; // Clean up...
WebRTC - FEC Out-of-Bounds Read
WebRTC - FEC Out-of-Bounds Read There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer:...
chromium-browser: Out of bounds read in WebRTC
An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...
Debian DSA-4289-1 : chromium-browser - security update
Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...
CVE-2018-16071
A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...