CVE-2018-17480

chromium-browser: Out of bounds write in V8

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 35.6% KEV · Listed

Vendors

Debian Google Redhat

Products

Debian Linux Chrome Enterprise Linux Desktop and 3 more

CVE-2018-6065

chromium-browser: integer overflow in v8

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 60.3% KEV · Listed

Vendors

Debian Google Mi and 1 more

Products

Debian Linux Chrome Mi6 Browser and 4 more

CVE-2019-13720

chromium-browser: use-after-free in audio

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 49.4% KEV · Listed

Vendors

Google Opensuse Redhat

Products

Chrome Leap Rhel Extras

CVE-2019-5786

chromium-browser: Use-after-free in FileReader

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 61.1% KEV · Listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2023-4863

libwebp: Heap buffer overflow in WebP Codec

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVSS 3.1 · 8.8 High EPSS 100.0% KEV · Listed

Vendors

Bandisoft Bentley Debian and 7 more

Products

Honeyview Seequent Leapfrog Debian Linux and 14 more

CVE-2023-5217

libvpx: Heap buffer overflow in vp8 encoding in libvpx

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.8 High EPSS 49.0% KEV · Listed

Vendors

Apple Debian Fedoraproject and 5 more

Products

Ipados Iphone Os Debian Linux and 12 more

CVE-2023-0266

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

CVSS 3.1 · 7.9 High EPSS 2.6% KEV · Listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Enterprise Linux and 5 more

CVE-2019-8506

webkitgtk: malicous web content leads to arbitrary code execution

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 16.2% KEV · Listed

Vendors

Apple Redhat

Products

Icloud Iphone Os Itunes and 7 more

CVE-2023-42916

webkitgtk: Out-of-bounds read leads to sensitive data leak

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVSS 3.1 · 6.5 Medium EPSS 17.8% KEV · Listed

Vendors

Apple Debian Fedoraproject and 2 more

Products

Ipados Iphone Os Macos and 6 more

CVE-2023-42917

webkitgtk: Arbitrary Remote Code Execution

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Listed

Vendors

Apple Debian Fedoraproject and 2 more

Products

Ipados Iphone Os Macos and 10 more

CVE-2023-37450

webkitgtk: arbitrary code execution

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 · 8.8 High EPSS 18.9% KEV · Listed

Vendors

Apple Redhat Webkitgtk

Products

Ipados Iphone Os Macos and 6 more

CVE-2023-28204

webkitgtk: an out-of-bounds read when processing malicious content

An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 · 6.5 Medium EPSS 14.3% KEV · Listed

Vendors

Apple Redhat Webkitgtk

Products

Ipados Iphone Os Macos and 6 more

CVE-2023-32373

webkitgtk: a use-after-free when processing maliciously crafted web content

A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, Safari 16.5, iOS 16.5 and iPadOS 16.5. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 · 8.8 High EPSS 12.2% KEV · Listed

Vendors

Apple Redhat Webkitgtk

Products

Ipados Iphone Os Macos and 6 more

CVE-2023-32435

webkitgtk: memory corruption issue leading to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.

CVSS 3.1 · 8.8 High EPSS 23.0% KEV · Listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 3 more

CVE-2023-32439

webkitgtk: type confusion issue leading to arbitrary code execution

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 · 8.8 High EPSS 24.0% KEV · Listed

Vendors

Apple Redhat Webkitgtk

Products

Ipados Iphone Os Macos and 4 more

CVE-2022-48503

webkitgtk: improper bounds checking leading to arbitrary code execution

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 5 more

CVE-2021-30761

webkitgtk: Memory corruption leading to arbitrary code execution

A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVSS 3.1 · 8.8 High EPSS 10.5% KEV · Listed

Vendors

Apple Redhat

Products

Iphone Os Enterprise Linux Rhel Els

CVE-2021-30762

webkitgtk: Use-after-free leading to arbitrary code execution

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

CVSS 3.1 · 8.8 High EPSS 11.0% KEV · Listed

Vendors

Apple Redhat

Products

Iphone Os Enterprise Linux Rhel Els

CVE-2023-23529

webkitgtk: processing maliciously crafted web content may be exploited for arbitrary code execution

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVSS 3.1 · 8.8 High EPSS 9.5% KEV · Listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 3 more

CVE-2022-42856

webkitgtk: processing maliciously crafted web content may lead to an arbitrary code execution

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

CVSS 3.1 · 8.8 High EPSS 8.5% KEV · Listed

Vendors

Apple Redhat

Products

Ipados Iphone Os Macos and 4 more