WebRTC - FEC Out-of-Bounds Read

WebRTC - FEC Out-of-Bounds Read There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer:...

WebRTC - VP9 Processing Use-After-Free

There is a use-after-free in VP9 processing in WebRTC. In the method RtpFrameReferenceFinder::ManageFrameVp9 the following code occurs: auto gofinfoit = gofinfo.findcodecheader.temporalidx == 0 ? codecheader.tl0picidx - 1 : codecheader.tl0picidx; ... // snip info = &gofinfoit-second; // Clean up...

WebRTC - FEC Out-of-Bounds Read

There is an out-of-bounds read in FEC processing in WebRTC. If a very short RTP packet is received, FEC will assume the packet is longer and process data outside of the allocated buffer. This bug causes the following ASAN crash: ==109993==ERROR: AddressSanitizer: heap-buffer-overflow on address...

chromium-browser: Out of bounds read in WebRTC

An out of bounds read in forward error correction code in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Debian DSA-4289-1 : chromium-browser - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2018-16065 Brendon Tiszka discovered an out-of-bounds write issue in the v8 JavaScript library. - CVE-2018-16066 cloudfuzzer discovered an out-of-bounds read issue in blink/webkit. - CVE-2018-16067 Zhe Jin discovered ...

CVE-2018-16071

A use after free in WebRTC in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially exploit heap corruption via a crafted video file...

PT-2018-3190

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81 Description The issue is related to a use after free in WebRTC, which can lead to heap corruption. A remote attacker can potentially exploit this by using a crafted video file. This may allow the...

PT-2018-3202

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 69.0.3497.81 Description The issue is related to an out of bounds read in the forward error correction code in WebRTC. A remote attacker could perform an out of bounds memory read via a crafted HTML page. This...

Mozilla Firefox ESR < 52.7 Multiple Vulnerabilities

Binary data 700335.prm...

Mozilla Firefox < 59 Multiple Vulnerabilities

Binary data 700328.prm...

openSUSE Security Update : seamonkey (openSUSE-2018-867)

This update for seamonkey fixes the following issues : Mozilla SeaMonkey was updated to 2.49.4 : Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998 : - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when...

Security update for seamonkey (important)

This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr boo1098998. Security issues fixed with MFSA 2018-16 boo1098998: CVE-2018-12359: Buffer overflow using computed size of canvas element CVE-2018-12360: Use-after-free when using...

WebRTC - H264 NAL Packet Processing Type Confusion Exploit

Exploit for multiple platform in category dos / poc Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/videocoding/packetbuffer.cc there is a loop on line 296 that goes through the databuffer vector backwards. The flag ish264 is set before th...

WebRTC - FEC Processing Overflow Exploit

Exploit for multiple platform in category dos / poc There are several calls to memcpy that can overflow the destination buffer in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket. The method takes a parameter incomingrtppacket, which is an RTP packet with a mac length that is defined by the...

WebRTC - VP8 Block Decoding Use-After-Free Exploit

Exploit for multiple platform in category dos / poc There is a use-after-free in VP8 block decoding in WebRTC. The contents of the freed block is then treated a pointer, leading to a crash in WebRTC. ==20098==ERROR: AddressSanitizer: heap-use-after-free on address 0x6330000a9491 at pc...

WebRTC - H264 NAL Packet Processing Type Confusion

WebRTC - H264 NAL Packet Processing Type Confusion Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/videocoding/packetbuffer.cc there is a loop on line 296 that goes through the databuffer vector backwards. The flag ish264 is set before thi...

WebRTC - FEC Processing Overflow

WebRTC - FEC Processing Overflow There are several calls to memcpy that can overflow the destination buffer in webrtc::UlpfecReceiverImpl::AddReceivedRedPacket. The method takes a parameter incomingrtppacket, which is an RTP packet with a mac length that is defined by the transport 2048 bytes for...

WebRTC - VP8 Block Decoding Use-After-Free

WebRTC - VP8 Block Decoding Use-After-Free There is a use-after-free in VP8 block decoding in WebRTC. The contents of the freed block is then treated a pointer, leading to a crash in WebRTC. ==20098==ERROR: AddressSanitizer: heap-use-after-free on address 0x6330000a9491 at pc 0x0000014cde2f bp...

WebRTC - H264 NAL Packet Processing Type Confusion

Type confusion can occur when processing a H264 packet. In the method PacketBuffer::FindFrames in modules/videocoding/packetbuffer.cc there is a loop on line 296 that goes through the databuffer vector backwards. The flag ish264 is set before this loop, and if it is true, the loop extracts and se...

WebRTC - VP8 Block Decoding Use-After-Free

There is a use-after-free in VP8 block decoding in WebRTC. The contents of the freed block is then treated a pointer, leading to a crash in WebRTC. ==20098==ERROR: AddressSanitizer: heap-use-after-free on address 0x6330000a9491 at pc 0x0000014cde2f bp 0x7ff20616d7e0 sp 0x7ff20616d7d8 READ of size...