CVE Vulnerability Catalog

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in Media in Google Chrome on Windows prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Uninitialized resource in GPU in Google Chrome on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An unauthenticated remote client can continue submitting authentication requests on one connection beyond the configured cap, bypassing the deployment's attempt-limiting policy and increasing online guessing opportunity and backend authentication workload.

Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote peer can then send a packet with a decrypted length of zero, causing russh/src/cipher/mod.rs to shrink the previously read block before indexing buffer.buffer[16..], which panics and terminates the connection task.

Uninitialized resource in GPU in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Severity: High)

Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome extension. (Severity: Medium)

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. (Severity: Low)

Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Severity: Medium)

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Severity: Low)

Incorrect authorization in WebAPKs in Google Chrome on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Severity: Medium)

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

Serialize JavaScript from version 7.1.1 until 7.1.2 does not fully protect serialized functions against script-closing tags in attacker-influenced function source. This can cause the script element to terminate early and the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected, and the issue is fixed in version 7.1.2.

SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over many signatures can lead to recovery of the private key. Applications performing SM2 signature generation are affected on all platforms.

OpenSSL's optimized scalar point multiplication implementation for SM2 private key operations on ARM64 and RISC-V platforms is not constant-time. Conditional branches and table lookups depend on the bits of the secret scalar, so execution time and cache-access patterns leak information about the private key or signature nonce.

The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves lacking a dedicated implementation leaks information about the secret nonce through timing. An attacker measuring signing times may learn the nonce, which over many signatures can lead to private key recovery.

The OpenSSL QUIC server, when address validation is disabled, can count incoming datagrams multiple times in its unvalidated credit computation. This violates the RFC 9000 3x amplification limit, allowing a remote attacker to use the server for DDoS amplification.

Flysystem prior to 3.35.3 has a vulnerability in the default WhitespacePathNormalizer that calls preg_match with the u modifier and treats both false and 0 as falsy. A path containing malformed UTF-8 causes PCRE to return false, allowing paths with control characters to bypass validation. This can lead to hidden or spoofed terminal file listings when an administrator displays them.

OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.