Zhe Jin

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 83.0.4103.61 **Descrição** O problema está relacionado a uma vulnerabilidade do tipo “use after free” no Blink, que pode permitir que um invasor remoto explore uma corrupção de heap por meio de uma página HTML maliciosa. Isso pode resultar em acesso não autorizado a dados confidenciais, violação da integridade dos dados e negação de serviço. **Recomendações** Para versões anteriores à 83.0.4103.61, atualize para a versão 83.0.4103.61 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 83.0.4103.61 **Descrição** O problema está relacionado a uma vulnerabilidade do tipo “use after free” no componente de mídia do Google Chrome, que pode ser explorada por um invasor remoto para acessar dados confidenciais, comprometer a integridade dos dados e causar uma negação de serviço por meio de uma página HTML especialmente criada. Isso pode permitir que o invasor escape da sandbox caso o processo de renderização seja comprometido. **Recomendações** Para versões anteriores à 83.0.4103.61, atualize para a versão 83.0.4103.61 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso a componentes de mídia potencialmente vulneráveis até que a atualização seja aplicada.

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 81.0.4044.129 **Descrição** A vulnerabilidade está relacionada a um problema de “use after free” na memória, o que poderia permitir que um invasor remoto que tivesse comprometido o processo do renderizador potencialmente escapasse da sandbox. Isso pode ser feito por meio de uma página HTML especialmente criada. A exploração desse problema pode permitir que um invasor acesse dados confidenciais, comprometa a integridade dos dados e cause uma negação de serviço. **Recomendações** Para versões anteriores à 81.0.4044.129, atualize para a versão 81.0.4044.129 ou posterior para resolver o problema. Como solução alternativa temporária, considere restringir o acesso a páginas HTML potencialmente maliciosas para minimizar o risco de exploração.

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 81.0.4044.129 **Descrição** O problema está relacionado a uma vulnerabilidade do tipo “use after free” no agendamento de tarefas, o que poderia permitir que um invasor remoto que tivesse comprometido o processo do renderizador potencialmente escapasse da sandbox por meio de uma página HTML maliciosa. Isso poderia levar ao acesso não autorizado a dados confidenciais, à violação da integridade dos dados e à negação de serviço. **Recomendações** Para versões do Google Chrome anteriores à 81.0.4044.129, atualize para a versão 81.0.4044.129 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 81.0.4044.122 **Descrição** A vulnerabilidade está relacionada a uma falha de “use after free” no mecanismo de pagamentos do Google Chrome, que pode ser explorada por um invasor remoto por meio de uma página HTML maliciosa. Isso poderia permitir que o invasor explorasse uma corrupção de heap. A exploração desse problema pode permitir que o invasor acesse dados confidenciais, comprometa a integridade dos dados e cause uma negação de serviço. **Recomendações** Para versões anteriores à 81.0.4044.122, atualize para a versão 81.0.4044.122 ou posterior para resolver o problema.

**Nome do software vulnerável e versões afetadas** Versões do Google Chrome anteriores à 80.0.3987.116 **Descrição** A vulnerabilidade permite que um invasor remoto possa explorar uma corrupção de heap por meio de uma página HTML maliciosa, o que poderia levar ao acesso não autorizado a dados confidenciais, negação de serviço ou comprometer a integridade dos dados. **Recomendações** Para versões anteriores à 80.0.3987.116, atualize para a versão 80.0.3987.116 ou posterior para resolver o problema.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.117 **Description** The issue is related to a use after free in the audio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to sensitive data, disruption of data integrity, and potentially cause a denial of service. **Recommendations** For versions prior to 79.0.3945.117, update to version 79.0.3945.117 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 79.0.3945.79 **Description** The issue is related to a use-after-free in WebSockets, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This may lead to unauthorized access to protected information and compromise its integrity and availability. **Recommendations** For versions prior to 79.0.3945.79, update to version 79.0.3945.79 or later to resolve the issue. As a temporary workaround, consider restricting access to WebSockets or avoiding the use of crafted HTML pages that could trigger the exploitation of this issue.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 12.4 macOS Mojave versions prior to 10.14.6 tvOS versions prior to 12.4 Safari versions prior to 12.1.2 iTunes for Windows versions prior to 12.9.6 iCloud for Windows versions prior to 7.13 and 10.6 **Description** The issue is caused by multiple memory corruption problems, which can be exploited by processing maliciously crafted web content, potentially leading to arbitrary code execution. This is due to a buffer overflow in the WebKit display module, allowing a remote attacker to execute arbitrary code. **Recommendations** For iOS versions prior to 12.4, update to iOS 12.4 or later. For macOS Mojave versions prior to 10.14.6, update to macOS Mojave 10.14.6 or later. For tvOS versions prior to 12.4, update to tvOS 12.4 or later. For Safari versions prior to 12.1.2, update to Safari 12.1.2 or later. For iTunes for Windows versions prior to 12.9.6, update to iTunes for Windows 12.9.6 or later. For iCloud for Windows versions prior to 7.13 and 10.6, update to iCloud for Windows 7.13 or 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 76.0.3809.132 **Description** The issue is related to a use after free in the Blink rendering engine of Google Chrome, which can be exploited by a remote attacker using a specially crafted HTML page. This could potentially lead to data corruption, unauthorized access to sensitive information, and denial of service. **Recommendations** For versions prior to 76.0.3809.132, update to version 76.0.3809.132 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially malicious web pages to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 72.0.3626.81 **Description** The issue is related to incorrect object lifecycle management in Blink, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, causing a denial of service. **Recommendations** For versions prior to 72.0.3626.81, update to version 72.0.3626.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 72.0.3626.81 **Description** The issue is related to insufficient checks of pointer validity in WebRTC, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to a denial of service. **Recommendations** For versions prior to 72.0.3626.81, update to version 72.0.3626.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 70.0.3538.67 **Description** The issue is related to the use of memory after it has been freed in the HTMLImportsController function of the Blink rendering engine in Google Chrome. This could allow a remote attacker to potentially exploit heap corruption by using a specially crafted HTML page. **Recommendations** For versions prior to 70.0.3538.67, update to version 70.0.3538.67 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 70.0.3538.67 **Description** A heap buffer overflow in the GPU of Google Chrome allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is related to a buffer overflow in the GPU engine, which could be exploited by a remote attacker using a specially crafted HTML page, potentially leading to a denial of service. **Recommendations** For versions prior to 70.0.3538.67, update to version 70.0.3538.67 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 71.0.3578.80 **Description** The issue is caused by the incorrect, thread-unsafe use of SkImage in Canvas, which can lead to heap corruption. A remote attacker can potentially exploit this issue via a crafted HTML page, allowing them to cause buffer overflow. **Recommendations** For versions prior to 71.0.3578.80, update to version 71.0.3578.80 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 69.0.3497.81 **Description** The issue is related to a use after free in the WebAudio component, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could potentially lead to a denial of service. **Recommendations** For versions prior to 69.0.3497.81, update to version 69.0.3497.81 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 68.0.3440.75 **Description** A race condition in the Oilpan component of Google Chrome allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 68.0.3440.75, update to version 68.0.3440.75 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 8.0 **Description** A remote code execution issue in the Android media framework's libavc library is related to inadequate access control. This allows a remote attacker to execute arbitrary code. **Recommendations** For Android versions 6.0 through 8.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2 through 7.1.2 **Description** The issue is related to a remote code execution vulnerability in the Android media framework, specifically in the libhevc library. This vulnerability is associated with insufficient access control, which can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For Android versions 5.0.2 through 7.1.2, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.2 **Description** The issue is related to a remote code execution vulnerability in the Android media framework, specifically in the libstagefright library. This vulnerability is associated with inadequate access control. It allows a remote attacker to execute arbitrary code. **Recommendations** For Android versions 6.0 through 7.1.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.