5N1P3R0010

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 114.0.5735.133 **Description** The issue is related to a type confusion in the V8 JavaScript engine, which can lead to heap corruption. A remote attacker could potentially exploit this issue via a crafted HTML page. The severity of this issue is considered high. **Recommendations** For versions prior to 114.0.5735.133, update to version 114.0.5735.133 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Visual Basic for Applications (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in Visual Basic for Applications, which is part of the Microsoft Office suite. This vulnerability can be exploited to reveal protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 96.0.4664.93 Microsoft Edge (affected versions not specified) **Description** The issue is related to a use after free vulnerability in the autofill function of the browsers. This could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, leading to the execution of arbitrary code or a denial of service. **Recommendations** For Google Chrome versions prior to 96.0.4664.93, update to version 96.0.4664.93 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue is related to the gf isom vp config get function in the MP4Box command of the GPAC multimedia platform. It is associated with NULL pointer dereference errors. Exploitation of this issue allows a remote attacker to cause a denial of service using a specially crafted file. **Recommendations** For GPAC version 1.0.1, consider disabling the gf isom vp config get function as a temporary workaround until a patch is available. Restrict access to the MP4Box command to minimize the risk of exploitation. Avoid using crafted files that could trigger the NULL pointer dereference error.

**Name of the Vulnerable Software and Affected Versions** GPAC versions 1.0.1 **Description** The issue is related to a memory leak in the `def parent box new` function of the MP4Box component in the GPAC multimedia platform. This leak occurs due to incorrect memory deallocation before the last reference is deleted. Exploitation of this issue allows a remote attacker to access confidential data by using a specially crafted file. **Recommendations** For GPAC version 1.0.1, update to a version that fixes the memory leak issue in the `def parent box new` function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue is related to the `gf odf desc copy` function in the MP4Box command, which allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file. This can be exploited by a remote attacker to disrupt service. **Recommendations** For GPAC version 1.0.1, consider disabling the `gf odf desc copy` function as a temporary workaround until a patch is available. Restrict access to the MP4Box command to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue is related to a heap buffer overflow in the `print udta` function in MP4Box, part of the GPAC multimedia platform. This allows attackers to cause a denial of service or potentially execute arbitrary code via a crafted file. The vulnerability can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service using a specially crafted file. **Recommendations** For GPAC version 1.0.1, consider disabling the `print udta` function in MP4Box as a temporary workaround until a patch is available. Restrict access to crafted files that could exploit this issue to minimize the risk of denial of service or arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue is related to the `abst box size` function in the MP4Box command, which allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file. This can be exploited by a remote attacker to disrupt service. **Recommendations** For GPAC version 1.0.1, consider disabling the `abst box size` function as a temporary workaround until a patch is available. Restrict access to the MP4Box command to minimize the risk of exploitation. Avoid using crafted files that could trigger the NULL pointer dereference.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue is related to the `trak box size` function in the MP4Box command, which allows attackers to cause a denial of service due to a NULL pointer dereference. This can be achieved by using a crafted file. The exploitation of this issue enables a remote attacker to disrupt service. **Recommendations** For GPAC version 1.0.1, consider disabling the `trak box size` function as a temporary workaround until a patch is available. Restrict access to the MP4Box command to minimize the risk of exploitation. Avoid using crafted files that could trigger the denial of service.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is due to a problem in the `gf isom cenc get default info internal` function. **Recommendations** For GPAC version 1.0.1, consider avoiding the use of crafted files with the MP4Box command until a patch is available. As a temporary workaround, restrict the execution of the `gf isom cenc get default info internal` function to prevent potential denial of service attacks.

**Name of the Vulnerable Software and Affected Versions** GPAC version 1.0.1 **Description** The issue allows attackers to cause a denial of service, specifically a NULL pointer dereference, by using a crafted file with the MP4Box command. This is related to the `HintFile` function. **Recommendations** For GPAC version 1.0.1, consider avoiding the use of crafted files with the MP4Box command until a fix is available. As a temporary workaround, restrict the use of the `HintFile` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: jpeg-xl version 0.3.2 Description: The issue is related to a heap buffer overflow in the `/lib/jxl/coeff order.cc` file, specifically in the `ReadPermutation` function. This can be triggered when decoding a malicious jxl file using djxl, potentially allowing an attacker to execute arbitrary code or cause a denial of service. Recommendations: For jpeg-xl version 0.3.2, consider avoiding the use of the `ReadPermutation` function in the `/lib/jxl/coeff order.cc` file until a patch is available. As a temporary workaround, restrict the decoding of jxl files using djxl to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** macOS Big Sur versions prior to 11.2 Security Update versions prior to 2021-001 Catalina Security Update versions prior to 2021-001 Mojave macOS Big Sur version 11.1 Security Update versions prior to 2020-001 Catalina Security Update versions prior to 2020-007 Mojave iOS versions prior to 14.3 iPadOS versions prior to 14.3 tvOS versions prior to 14.3 **Description** Processing a maliciously crafted file may lead to heap corruption. **Recommendations** For macOS Big Sur versions prior to 11.2, update to macOS Big Sur 11.2. For Security Update versions prior to 2021-001 Catalina, apply Security Update 2021-001 Catalina. For Security Update versions prior to 2021-001 Mojave, apply Security Update 2021-001 Mojave. For macOS Big Sur version 11.1, update to macOS Big Sur 11.2. For Security Update versions prior to 2020-001 Catalina, apply Security Update 2020-001 Catalina or later. For Security Update versions prior to 2020-007 Mojave, apply Security Update 2020-007 Mojave or later. For iOS versions prior to 14.3, update to iOS 14.3. For iPadOS versions prior to 14.3, update to iPadOS 14.3. For tvOS versions prior to 14.3, update to tvOS 14.3.