CWE-758

Podatność krytyczna (CVSS 9.8) w komponencie WebRTC: Signaling przeglądarki Mozilla Firefox oraz klienta pocztowego Thunderbird. Umożliwia zdalnemu atakującemu bez uwierzytelnienia wykonanie potencjalnie groźnych operacji poprzez sieć.

Podatność klasy CWE-758 (undefined behavior) w komponencie Audio/Video przeglądarki Firefox oraz klienta pocztowego Thunderbird umożliwia zdalnym atakującym naruszenie poufności i integralności danych bez jakiejkolwiek autoryzacji. Ocena CVSS 9.1 (Critical) wskazuje na wysoką krytyczność zagrożenia.

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1 and below have Undefined Behavior in its CIccCLUT::Init function which initializes and sets the size of a CLUT. This issue is fixed in version 2.3.1.1.

Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. In versions 2.3.1.1 and below, CIccXmlArrayType() contains a Null Pointer Dereference and Undefined Behavior vulnerability. This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in icSigCalcOp(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccTagXmlFloatNum<>::ParseXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior and Null Pointer Deference in CIccProfileXml::ParseBasic(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

iccDEV provides libraries and tools for interacting with, manipulating, and applying ICC color management profiles. Versions 2.3.1.1 and below have Undefined Behavior in CIccTagXmlSegmentedCurve::ToXml(). This occurs when user-controllable input is unsafely incorporated into ICC profile data or other structured binary blobs. Successful exploitation may allow an attacker to perform DoS, manipulate data, bypass application logic and Code Execution. This issue has been fixed in version 2.3.1.2.

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagSpectralViewingConditions()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLut16::Read()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagLutAtoB::Validate()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in `CIccTagCurve::CIccTagCurve()`. This vulnerability affects users of the iccDEV library who process ICC color profiles. Version 2.3.1.2 contains a patch. No known workarounds are available.

W Eclipse OpenJ9 w wersjach do 0.60, podczas wykonywania plików klas, gdzie wcześniej konkretna metoda superklasy została ponownie skompilowana jako abstrakcyjna, wykonanie jest nieprawidłowo delegowane do domyślnej metody interfejsu.

The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.

iccDEV udostępnia zestaw bibliotek i narzędzi do pracy z profilami zarządzania kolorami ICC. Przed wersją 2.3.1.6 crafted profil ICC może spowodować Undefined Behavior w funkcji CIccCalculatorFunc::ApplySequence() z powodu ładowania nieprawidłowych wartości enum dla icChannelFuncSignature. Problem przejawia się w UBSan jako "load of value … not a valid value for type icChannelFuncSignature", wskazując na zamieszanie między typami/wartościami enum podczas przetwarzania profilu ICC. Problem został naprawiony w wersji 2.3.1.6.

iccDEV dostarcza zestaw bibliotek i narzędzi do pracy z profilami zarządzania kolorami ICC. W wersjach poprzedzających 2.3.1.6 skonstruowany profil ICC może wyzwolić Undefined Behavior w funkcji CIccOpDefEnvVar::Exec() z powodu załadowania nieprawidłowych wartości enum dla icSigCmmEnvVar. Problem przejawia się w UBSan jako „load of value … not a valid value for type icSigCmmEnvVar", co wskazuje na nieprawidłową wartość enum/typu konsumowaną podczas przetwarzania profilu ICC. Podatność została naprawiona w wersji 2.3.1.6.

iccDEV dostarcza zestaw bibliotek i narzędzi do pracy z profilami zarządzania kolorami ICC. Przed wersją 2.3.1.6 warunek Undefined Behavior (UB) w pliku IccUtil.cpp może być wyzwolony przez crafted profil ICC podczas uruchamiania iccDumpProfile. Problem został naprawiony w wersji 2.3.1.6.

iccDEV to zestaw bibliotek i narzędzi do pracy z profilami zarządzania kolorami ICC. W wersjach przed 2.3.1.6 istnieje warunek Undefined Behavior w pliku IccUtil.cpp, który jest wyzwalany przez crafted input profile. Pod UndefinedBehaviorSanitizer problem jest raportowany jako nieprawidłowe operacje левого shiftu na icUInt32Number (unsigned 32-bit), gdzie przesunięta wartość "nie może być reprezentowana" w tym typie. Problem został naprawiony w wersji 2.3.1.6.

OpenPLC_V3 has a vulnerability in the enipThread function that occurs due to the lack of a return value. This leads to a crash when the server loop ends and execution hits an illegal ud2 instruction. This issue can be triggered remotely without authentication by starting the same server multiple times or if the server exits unexpectedly. The vulnerability allows an attacker to cause a Denial of Service (DoS) against the PLC runtime, stopping any PC started remotely without authentication. This results in the PLC process crashing and halting all automation or control logic managed by OpenPLC.