A flaw was found in OpenSSL. It is possible to trigger an infinite loop by crafting a certificate that has invalid elliptic curve parameters. Since certificate parsing happens before verification of the certificate signature, any process that parses an externally supplied certificate may be subject to a denial of service attack.
In SQLite before 3.32.3 select.c mishandles query-flattener optimization leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
AMD. A buffer overflow issue was addressed with improved memory handling.
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.
A flaw was found in libxml2. A call to the xmlGetID function can return a pointer already freed when parsing an XML document with the XMLPARSEDTDVALID option and without the XMLPARSENOENT option, resulting in a use-after-free issue.
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
A flaw was found in httpd. The inbound connection is not closed when it fails to discard the request body, which may expose the server to HTTP request smuggling.
A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
A flaw was found in WebKitGTK. A validation issue was addressed with improved input sanitization.
Reference: https://webkitgtk.org/security/WSA-2022-0002.html
A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
A flaw was found in WebKitGTK.
Impact: A remote attacker may be able to cause arbitrary code execution. Description: A logic issue was addressed with improved restrictions.
Reference: https://webkitgtk.org/security/WSA-2021-0003.html
A flaw was found in WebKitGTK.
Impact: A malicious website may be able to access restricted ports on arbitrary servers. Description: A port redirection issue was addressed with additional port validation.
Reference: https://webkitgtk.org/security/WSA-2021-0002.html
REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
"Clear History and Website Data" did not clear the history. The issue was addressed with improved data deletion. This issue is fixed in macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, iOS 14.3 and iPadOS 14.3, tvOS 14.3. A user may be unable to fully delete browsing history.
ActionKit. An input validation issue was addressed with improved input validation.
A use-after-free bug in the usersctp library was reported upstream. We assume this could have led to memory corruption and a potentially exploitable crash.
A flaw was found in WebKitGTK.
Impact: A remote attacker may be able to cause arbitrary code execution. Description: A logic issue was addressed with improved restrictions.
Reference: https://webkitgtk.org/security/WSA-2021-0002.html
A flaw was found in WebKitGTK.
Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: This issue was addressed with improved iframe sandbox enforcement.
Reference: https://webkitgtk.org/security/WSA-2021-0002.html
A flaw was found in WebKitGTK.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A type confusion issue was addressed with improved state handling.
Reference: https://webkitgtk.org/security/WSA-2021-0002.html
A flaw was found in WebKitGTK.
Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A use after free issue was addressed with improved memory management.
Reference: https://webkitgtk.org/security/WSA-2021-0003.html
A flaw was found in WebKitGTK.
Impact: Maliciously crafted web content may violate iframe sandboxing policy. Description: This issue was addressed with improved iframe sandbox enforcement.
Reference: https://webkitgtk.org/security/WSA-2021-0002.html
apache. Multiple issues were addressed by updating apache to version 2.4.53.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
apache. Multiple issues were addressed by updating apache to version 2.4.53.
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).