A flaw was found in libxml2. Parsing a XML document with the XMLPARSEHUGE option enabled can result in an integer overflow because safety checks were missing in some functions. Also, the xmlParseEntityValue function didn't have any length limitation.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
A flaw was found in libxml2. When a reference cycle is detected in the XML entity cleanup function the XML entity data can be stored in a dictionary. In this case, the dictionary becomes corrupted resulting in logic errors, including memory errors like double free.
AMD. A memory corruption issue was addressed with improved input validation.
AMD. A memory corruption issue was addressed with improved input validation.
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to code execution.
AMD. A memory corruption issue was addressed with improved input validation.
A use after free issue was addressed with improved memory management. https://webkitgtk.org/security/WSA-2022-0004.html#CVE-2022-22624
A flaw was found in libxml2. A call to the xmlGetID function can return a pointer already freed when parsing an XML document with the XMLPARSEDTDVALID option and without the XMLPARSENOENT option, resulting in a use-after-free issue.
A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
AMD. A memory corruption issue was addressed with improved input validation.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write.
A use after free issue was addressed with improved memory management. https://webkitgtk.org/security/WSA-2022-0004.html#CVE-2022-22628
A logic issue was addressed with improved state management. https://webkitgtk.org/security/WSA-2022-0004.html#CVE-2022-22637
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
AMD. A memory corruption issue was addressed with improved input validation.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
Accelerate Framework. A memory consumption issue was addressed with improved memory handling.
A buffer overrun vulnerability was found in Ruby. The issue occurs in a conversion algorithm from a String to a Float that causes process termination due to a segmentation fault, but under limited circumstances. This flaw may cause an illegal memory read.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.
A flaw was found in WebKitGTK. An use-after-free issue was addressed with improved memory management.
Reference: https://webkitgtk.org/security/WSA-2022-0001.html