An

issue

has

been

found

in

There

is

a

use-after-free

in

the

getState

function

in

as

demonstrated

by

and


VMware Workstation (15.x before 15.1.0) contains a use-after-free vulnerability in the Advanced Linux Sound Architecture (ALSA) backend. A malicious user with normal user privileges on the guest machine may exploit this issue in conjunction with other issues to execute code on the Linux host where Workstation is installed.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit PDF Reader version 9.7.0.29435. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


An exploitable use-after-free vulnerability exists in the Length parsing function of NitroPDF. A specially crafted PDF can cause a type confusion resulting in a use-after-free condition. An attacker can craft a malicious PDF to trigger this vulnerability.


An exploitable use-after-free vulnerability exists in the way LZW-compressed streams are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer resulting in a use-after-free condition. To trigger this vulnerability a specifically crafted PDF document needs to be processed by the target application.


An exploitable code execution vulnerability exists in the processing of multi-part/form-data requests within the base GoAhead web server application in versions v5.0.1 v.4.1.1 and v3.6.5. A specially crafted HTTP request can lead to a use-after-free condition during the processing of this request that can be used to corrupt heap structures that could lead to full code execution. The request can be unauthenticated in the form of GET or POST requests and does not require the requested resource to exist on the server.


An exploitable Use-After-Free vulnerability exists in the way FunctionType 0 PDF elements are processed in Aspose.PDF 19.2 for C++. A specially crafted PDF can cause a dangling heap pointer resulting in a use-after-free. An attacker can send a malicious PDF to trigger this vulnerability.


Potential

use-after-free

heap

error

during

Validate/Present

calls

on

display

HW

composer

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in


Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8096AU MDM9607 MSM8909W Nicobar QCS605 SA6155P SDA845 SDM429W SDM670 SDM710 SDM845 SM6150 SM8150 SM8250 SXR1130 SXR2130


Use

after

free

of

a

pointer

in

iWLAN

scenario

during

netmgr

state

transition

to

CONNECT

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in


An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g. by the close of a pair of pipes) after the return of vfs_poll() and this will cause a use-after-free.


Use

after

free

issue

in

Xtra

daemon

shutdown

due

to

static

object

instance

getting

freed

from

a

multiple

places

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Possible

use

after

free

issue

due

to

improper

input

validation

in

volume

listener

library

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Use

after

free

issue

in

kernel

while

accessing

freed

mdlog

session

info

and

its

attributes

after

closing

the

session

in

Snapdragon

Auto

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Lack

of

check

for

a

negative

value

returned

for

is

wrongly

interpreted

as

valid

pointer

and

lead

to

use

after

free

in

clk

driver

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Use after free issue occurs If the real device interface goes down and a route lookup is performed while sending a raw IPv6 message in Snapdragon Auto Snapdragon Compute Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8053 APQ8096AU APQ8098 MDM9206 MDM9207C MDM9607 MDM9640 MDM9650 MSM8917 MSM8937 MSM8996AU QCN7605 SDA845 SDM630 SDM636 SDM660 SDX20 SXR1130


Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8096AU MSM8909W Nicobar QCS605 SA6155P SDA845 SDM429W SDM670 SDM710 SDM845 SM6150 SM8150 SM8250 SXR1130 SXR2130


Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previous command teardwon sequence in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8098 MSM8909W Nicobar QCS405 QCS605 SDA845 SDM660 SDM670 SDM710 SDM845 SDX24 SM6150 SM7150 SM8150 SM8250 SXR2130


While

trying

to

obtain

datad

ipc

handle

during

DPL

initialization

Heap

use-after-free

issue

can

occur

if

modem

SSR

occurs

at

same

time

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Wearables

in

Nicobar


When kernel thread unregistered listener Use after free issue happened as the listener client`s private data has been already freed in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in MDM9607 MSM8909W Nicobar QCM2150 QCS405 QCS605 Saipan SC8180X SDM429W SDX55 SM8150 SM8250 SXR2130


is

assigned

to

local

instance

of

audio

device

pointer

after

free

instead

of

global

static

pointer

and

can

lead

to

use

after

free

issue

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto Snapdragon Compute Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music in Nicobar QCS405 Rennell Saipan SC8180X SDX55 SM6150 SM7150 SM8150 SM8250 SXR2130


Use

after

free

issue

occurs

If

another

instance

of

open

for

node

has

been

called

from

application

without

closing

the

previous

one.

in

Snapdragon

Auto

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Qualcomm

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7 Firefox < 67 and Firefox ESR < 60.7.


When following the value's prototype chain it was possible to retain a reference to a locale delete it and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 70 Thunderbird < 68.2 and Firefox ESR < 68.2.


An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is removed related to drivers/char/ipmi/ipmi_si_intf.c drivers/char/ipmi/ipmi_si_mem_io.c and drivers/char/ipmi/ipmi_si_port_io.c.


It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69 Thunderbird < 68.1 Thunderbird < 60.9 Firefox ESR < 60.9 and Firefox ESR < 68.1.


In the course of decompressing HPACK inside the HTTP2 protocol an unexpected sequence of header table resize operations can place the header table into a corrupted state leading to a use-after-free condition and undefined behavior. This issue affects Proxygen from v0.29.0 until v2017.04.03.00.


A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69 Thunderbird < 68.1 Thunderbird < 60.9 Firefox ESR < 60.9 and Firefox ESR < 68.1.


If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive sets a last will and testament sets a will delay interval sets a session expiry interval and the will delay interval is set longer than the session expiry interval then a use after free error occurs which has the potential to cause a crash in some situations.


The Linux kernel before 5.1-rc5 allows page->_refcount reference count overflow with resultant use-after-free issues if about 140 GiB of RAM exists. This is related to fs/fuse/dev.c fs/pipe.c fs/splice.c include/linux/mm.h include/linux/pipe_fs_i.h kernel/trace/trace.c mm/gup.c and mm/hugetlb.c. It can occur with FUSE requests.


An issue was discovered in the libflate crate before 0.1.25 for Rust. MultiDecoder::read has a use-after-free leading to arbitrary code execution.


An issue was discovered in the Linux kernel before 5.0.5. There is a use-after-free issue when hci_uart_register_dev() fails in hci_uart_set_proto() in drivers/bluetooth/hci_ldisc.c.


An

issue

was

discovered

in

the

Linux

kernel

before

There

is

a

use-after-free

caused

by

a

malicious

USB

device

in

the

driver.


An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.


An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/usb/cpia2/cpia2_usb.c driver.


An issue was discovered in the Linux kernel before 5.0.9. There is a use-after-free in atalk_proc_exit related to net/appletalk/atalk_proc.c net/appletalk/ddp.c and net/appletalk/sysctl_net_atalk.c.


An issue was discovered in the Linux kernel before 5.0.10. SMB2_write in fs/cifs/smb2pdu.c has a use-after-free.


An issue was discovered in the Linux kernel before 5.0.10. SMB2_read in fs/cifs/smb2pdu.c has a use-after-free. NOTE: this was not fixed correctly in 5.0.10; see the 5.0.11 ChangeLog which documents a memory leak.


In the Linux kernel a certain net/ipv4/tcp_output.c change which was properly incorporated into 4.16.12 was incorrectly backported to the earlier longterm kernels introducing a new vulnerability that was potentially more severe than the issue that was intended to be fixed by backporting. Specifically by adding to a write queue between disconnection and re-connection a local attacker can trigger multiple use-after-free conditions. This can result in a kernel crash or potentially in privilege escalation. NOTE: this affects (for example) Linux distributions that use 4.9.x longterm kernels before 4.9.190 or 4.14.x longterm kernels before 4.14.139.


An issue was discovered in the Linux kernel before 5.0.10. There is a use-after-free in the sound subsystem because card disconnection causes certain data structures to be deleted too early. This is related to sound/core/init.c and sound/core/info.c.


Possibility

of

use-after-free

and

double

free

because

of

not

marking

buffer

as

after

freeing

can

lead

to

dangling

pointer

access

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar


Close

and

bind

operations

done

on

a

socket

can

lead

to

a

Use-After-Free

condition.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

Electronics

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

IoT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in


Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in APQ8009 MDM9206 MDM9207C MDM9607 QCS605 SDM429W SDX24 SM8150 SXR1130


Memory

use

after

free

issue

in

audio

due

to

lack

of

resource

control

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Nicobar

Rennell

Saipan


An issue was discovered in Xpdf 4.01.01. There is a use-after-free in the function JPXStream::fillReadBuf at JPXStream.cc due to an out of bounds read.


Use

after

free

while

processing

eeprom

query

as

there

is

a

chance

to

not

unlock

mutex

after

error

occurs

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell


u'Whenever the page list is updated via privileged user the previous list elements are freed but are not deleted from the list which results in a use after free causing an unhandled page fault exception in rmnet driver' in Snapdragon Auto Snapdragon Compute Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables in Bitra MDM9607 QCS405 Saipan SC8180X SDX55 SM6150 SM7150 SM8150 SM8250 SXR2130


Use-after-free

in

graphics

module

due

to

destroying

already

queued

syncobj

in

error

case

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

in

Nicobar

Rennell

Saipan


A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected. When a registration is later freed with the removal of the animation controller element the refresh driver incorrectly leaves a dangling pointer to the driver's observer array. This vulnerability affects Thunderbird < 60.6 Firefox ESR < 60.6 and Firefox < 66.


A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.6 Firefox ESR < 60.6 and Firefox < 66.


Adobe Acrobat and Reader versions 2019.021.20056 and earlier 2017.011.30152 and earlier 2017.011.30155 and earlier version 2017.011.30152 and earlier and 2015.006.30505 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .


An issue was discovered in the image crate before 0.21.3 for Rust affecting the HDR image format decoder. Vec::set_len is called on an uninitialized vector leading to a use-after-free and arbitrary code execution.


An issue was discovered in the portaudio-rs crate through 0.3.1 for Rust. There is a use-after-free with resultant arbitrary code execution because of a lack of unwind safety in stream_callback and stream_finished_callback.


An issue was discovered in the chttp crate before 0.1.3 for Rust. There is a use-after-free during buffer conversion.


A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states \This use-after-free is triggered prior to the double free reported in CVE-2017-12858.\


Adobe Acrobat and Reader versions 2019.012.20035 and earlier 2019.012.20035 and earlier 2017.011.30142 and earlier 2017.011.30143 and earlier 2015.006.30497 and earlier and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.012.20040 and earlier 2017.011.30148 and earlier 2017.011.30148 and earlier 2015.006.30503 and earlier and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.6. A remote attacker may be able to cause arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2 tvOS 12.2 Safari 12.1 iTunes 12.9.4 for Windows iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3 tvOS 12.3 watchOS 5.2.1. A remote attacker may be able to cause arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.4 tvOS 12.4 watchOS 5.3. A remote attacker may be able to cause arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in AirPort Base Station Firmware Update 7.8.1 AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able to cause arbitrary code execution.


Xen 4.2.x 4.1.x and earlier when the hypervisor is running \under memory pressure\ and the Xen Security Module (XSM) is enabled uses the wrong ordering of operations when extending the per-domain event channel tracking table which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.


Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allows local users to gain privileges via a crafted application aka \Win32k Use After Free Vulnerability.\


A use-after-free flaw was found in nci_request in net/nfc/nci/core.c in NFC Controller Interface (NCI) in the Linux kernel. This flaw could allow a local attacker with user privileges to cause a data race problem while the device is getting removed leading to a privilege escalation problem.


A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw an attacker with a user privileges may crash the system or leak internal kernel information.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed PDF file that could result in disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Wasmtime

is

an

open

source

runtime

for

WebAssembly

WASI.

In

Wasmtime

from

version

and

before

version

there

was

a

use-after-free

bug

when

passing

`externref`s

from

the

host

to

guest

Wasm

content.

To

trigger

the

bug

you

have

to

explicitly

pass

multiple

`externref`s

from

the

host

to

a

Wasm

instance

at

the

same

time

either

by

passing

multiple

`externref`s

as

arguments

from

host

code

to

a

Wasm

function

or

returning

multiple

`externref`s

to

Wasm

from

a

multi-value

return

function

defined

in

the

host.

If

you

do

not

have

host

code

that

matches

one

of

these

shapes

then

you

are

not

impacted.

If

Wasmtime's

`VMExternRefActivationsTable`

became

filled

to

capacity

after

passing

the

first

`externref`

in

then

passing

in

the

second

`externref`

could

trigger

a

garbage

collection.

However

the

first

`externref`

is

not

rooted

until

we

pass

control

to

Wasm

and

therefore

could

be

reclaimed

by

the

collector

if

nothing

else

was

holding

a

reference

to

it

or

otherwise

keeping

it

alive.

Then

when

control

was

passed

to

Wasm

after

the

garbage

collection

Wasm

could

use

the

first

`externref`

which

at

this

point

has

already

been

freed.

We

have

reason

to

believe

that

the

effective

impact

of

this

bug

is

relatively

small

because

usage

of

`externref`

is

currently

quite

rare.

The

bug

has

been

fixed

and

users

should

upgrade

to

Wasmtime

If

you

cannot

upgrade

Wasmtime

yet

you

can

avoid

the

bug

by

disabling

reference

types

support

in

Wasmtime

by

passing

`false`

to

`wasmtime::Config::wasm_reference_types`.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed project file which may allow arbitrary code execution.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20155 (and earlier) 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the nano_arena crate before 0.5.2 for Rust. There is an aliasing violation in split_at because two mutable references can exist for the same element if Borrow<Idx> behaves in certain ways. This can have a resultant out-of-bounds write or use-after-free.


Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.


Adobe Illustrator version 25.2.3 (and earlier) is affected by a Use After Free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose potential sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability when executing search queries through Javascript. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions versions 2021.001.20150 (and earlier) 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the Linux kernel before 5.11.9. drivers/vhost/vdpa.c has a use-after-free because v->config_ctx has an invalid value upon re-opening a character device aka CID-f6bbf0010ba0.


A use-after-free vulnerability when parsing a specially crafted file in Esri ArcReader ArcGIS Desktop ArcGIS Engine 10.8.1 (and earlier) and ArcGIS Pro 2.7 (and earlier) allows an unauthenticated attacker to achieve arbitrary code execution in the context of the current user.


An issue was discovered in the rocket crate before 0.4.7 for Rust. uri::Formatter can have a use-after-free if a user-provided function panics.


In FreeBSD 13.0-STABLE before n245050 12.2-STABLE before r369525 13.0-RC4 before p0 and 12.2-RELEASE before p6 listening socket accept filters implementing the accf_create callback incorrectly freed a process supplied argument string. Additional operations on the socket can lead to a double free or use after free.


A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality integrity as well as system availability. Versions before kernel 5.12-rc6 are affected


A flaw was found in ImageMagick where it did not properly sanitize certain input before using it to invoke convert processes. This flaw allows an attacker to create a specially crafted image that leads to a use-after-free vulnerability when processed by ImageMagick. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


nbd_add_socket in drivers/block/nbd.c in the Linux kernel through 5.10.12 has an ndb_queue_rq use-after-free that could be triggered by local attackers (with access to the nbd device) via an I/O request at a certain point during device setup aka CID-b98e762e3d71.


A use-after-free vulnerability was found in usbredir in versions prior to 0.11.0 in the usbredirparser_serialize() in usbredirparser/usbredirparser.c. This issue occurs when serializing large amounts of buffered write data in the case of a slow or blocked destination.


There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality integrity and availability.


A flaw was found in the \Routing decision\ classifier in the Linux kernel's Traffic Control networking subsystem in the way it handled changing of classification filters leading to a use-after-free condition. This flaw allows unprivileged local users to escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared the user credentials state was only pointed at and when one connection within that association group ended the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.


An issue was discovered in the Linux kernel through 5.10.11. PI futexes have a kernel stack use-after-free during fault handling allowing local users to execute code in the kernel aka CID-34b1a1ce1458.


A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible use-after-free due to lack of validation for the rule count in filter table in IPA driver in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. Processing maliciously crafted web content may lead to arbitrary code execution.


A use-after-free vulnerability exists when reading a DWF/DWFX file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists with parsing DWF/DWFX files. Crafted data in a DWF/DWFX file and lack of proper validation of input data can trigger a write operation past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


A vulnerability has been identified in JT2Go (All versions < V13.2.0.5) Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057)


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A vulnerability has been identified in JT Utilities (All versions < V13.0.3.0) JTTK (All versions < V11.0.3.0). JTTK library in affected products contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14911)


An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input can cause the bounds of a for loop to be miscalculated which leads to a use after free condition a pointer is pushed into previously free memory by the loop.


A vulnerability has been identified in JT Utilities (All versions < V13.1.1.0) JTTK (All versions < V11.1.1.0). JTTK library in affected products contains a use after free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-14900)


Acrobat Reader DC versions 2021.005.20054 (and earlier) 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile


An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A patch operation may result in a use-after-free.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.


Adobe Bridge version 11.1.2 (and earlier) and version 12.0 (and earlier) are affected by an use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the lru crate before 0.7.1 for Rust. The iterators have a use-after-free as demonstrated by an access after a pop operation.


Adobe InDesign version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_window_function has a use-after-free.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_aggregate_function has a use-after-free.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.


Adobe InCopy version 16.4 (and earlier) is affected by a use-after-free vulnerability in the processing of a JPEG2000 file that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_collation has a use-after-free.


An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 21.007.20099 (and earlier) 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. create_scalar_function has a use-after-free.


An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. commit_hook has a use-after-free.


A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files allowing an attacker to craft a special project file that may permit arbitrary code execution.


A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool. Affected Product: Eurotherm by Schneider Electric GUIcon Version 2.0 (Build 683.003) and prior


VMware ESXi Workstation and Fusion contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.


There is a use after free vulnerability in Taurus-AL00A 10.0.0.1(C00E1R1P1). A module may refer to some memory after it has been freed while dealing with some messages. Attackers can exploit this vulnerability by sending specific message to the affected module. This may lead to module crash compromising normal service.


There is a use-after-free vulnerability in a Huawei product. A module cannot deal with specific operations in special scenarios. Attackers can exploit this vulnerability by performing malicious operations. This can cause memory use-after-free compromising normal service. Affected product include some versions of NIP6300 NIP6600 NIP6800 S1700 S2700 S5700 S6700 S7700 S9700 Secospace USG6300 Secospace USG6500 Secospace USG6600 and USG9500.


A vulnerability has been identified in Solid Edge SE2021 (All Versions < SE2021MP7). The PSKERNEL.dll library in affected application lacks proper validation while parsing user-supplied OBJ files that could lead to a use-after-free condition. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-13777)


There is a use-after-free (UAF) vulnerability in Huawei products. An attacker may craft specific packets to exploit this vulnerability. Successful exploitation may cause the service abnormal. Affected product versions include:CloudEngine 12800 V200R005C10SPC800 V200R019C00SPC800;CloudEngine 5800 V200R005C10SPC800 V200R019C00SPC800;CloudEngine 6800 V200R005C10SPC800 V200R005C20SPC800 V200R019C00SPC800;CloudEngine 7800 V200R005C10SPC800 V200R019C00SPC800.


TensorFlow

is

an

end-to-end

open

source

platform

for

machine

learning.

In

affected

versions

the

implementation

for

can

result

in

a

use

after

free

error

if

an

attacker

supplies

specially

crafted

arguments.

The

uses

a

reference

counted

resource

and

decrements

the

refcount

if

the

initialization

fails

as

it

should.

However

when

the

code

was

written

the

resource

was

represented

as

a

naked

pointer

but

later

refactoring

has

changed

it

to

be

a

smart

pointer.

Thus

when

the

pointer

leaves

the

scope

a

subsequent

`free`-ing

of

the

resource

occurs

but

this

fails

to

take

into

account

that

the

refcount

has

already

reached

thus

the

resource

has

been

already

freed.

During

this

double-free

process

members

of

the

resource

object

are

accessed

for

cleanup

but

they

are

invalid

as

the

entire

resource

has

been

freed.

We

have

patched

the

issue

in

GitHub

commit

The

fix

will

be

included

in

TensorFlow

We

will

also

cherrypick

this

commit

on

TensorFlow

TensorFlow

and

TensorFlow

as

these

are

also

affected

and

still

in

supported

range.


A vulnerability has been identified in NX 1980 Series (All versions < V1984) Solid Edge SE2021 (All versions < SE2021MP8). The IFC adapter in affected application contains a use-after-free vulnerability that could be triggered while parsing user-supplied IFC files. An attacker could leverage this vulnerability to execute code in the context of the current process.


An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexer_compare_identifier_to_string in js-lexer.c file.


XMP Toolkit SDK versions 2020.1 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Illustrator version 25.2.3 (and earlier) is affected by an Use-after-free vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to read arbitrary file system information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in libde265 v1.0.8.There is a Heap-use-after-free in intrapred.h when decoding file using dec265.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A use-after-free vulnerability exists in the NMR::COpcPackageReader::releaseZIP() functionality of 3MF Consortium lib3mf 2.0.0. A specially crafted 3MF file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Acrobat Pro DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a Use-after-free vulnerability when parsing a specially crafted PDF file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause an object containing the path to a document to be destroyed and then later reused resulting in a use-after-free vulnerability which can lead to code execution under the context of the application. An attacker can convince a user to open a document to trigger this vulnerability.


Acrobat Reader DC versions versions 2020.013.20074 (and earlier) 2020.001.30018 (and earlier) and 2017.011.30188 (and earlier) are affected by a use-after-free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A code execution vulnerability exists in the dxfRW::processLType() functionality of LibreCad libdxfrw 2.2.0-rc2-19-ge02f3580. A specially-crafted .dxf file can lead to a use-after-free vulnerability. An attacker can provide a malicious file to trigger this vulnerability.


Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A use after free vulnerability in conn_gadget driver prior to SMR AUG-2021 Release 1 allows malicious action by an attacker.


Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0 Firefox ESR < 91.4.0 and Firefox < 95.


A Use After Free vulnerability exists in the DGN file reading procedure in Open Design Alliance Drawings SDK before 2022.8. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.


An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access.


A Use-After-Free Remote Vulnerability exists when reading a DWG file using Open Design Alliance Drawings SDK before 2022.11. The specific issue exists within the parsing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.


An issue was discovered in gatt-database.c in BlueZ 5.61. A use-after-free can occur when a client disconnects during D-Bus processing of a WriteValue call.


A vulnerability has been identified in NX 1953 Series (All versions < V1973.3700) NX 1980 Series (All versions < V1988) Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13771).


A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13773).


A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13789).


TensorFlow is an open source platform for machine learning. In affected versions the async implementation of `CollectiveReduceV2` suffers from a memory leak and a use after free. This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1 as this version is the only one that is also affected.


A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13776).


A vulnerability has been identified in Solid Edge SE2021 (All versions < SE2021MP8). The affected application contains a use-after-free vulnerability while parsing OBJ files. An attacker could leverage this vulnerability to execute code in the context of the current process (ZDI-CAN-13778).


An issue was discovered on LG mobile devices with Android OS 8.0 8.1 9.0 and 10 software. The USB laf gadget has a use-after-free. The LG ID is LVE-SMP-200031 (February 2021).


An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_is_lexical_environment in the ecma-helpers.c file.


An issue was discovered in JerryScript 2.4.0. There is a heap-use-after-free in ecma_bytecode_ref in ecma-helpers.c file.


A user may be tricked into opening a malicious FBX file which may exploit a use-after-free vulnerability in FBX's Review causing the application to reference a memory location controlled by an unauthorized third party thereby running arbitrary code on the system.


An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free.


Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible use after free due to improper memory validation when initializing new interface via Interface add command in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wired Infrastructure and Networking


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7 tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.7 Safari 14.1.2 macOS Big Sur 11.5 watchOS 7.6 tvOS 14.7. Processing maliciously crafted web content may lead to arbitrary code execution.


A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..


Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page.


Possible use after free due improper validation of reference from call back to internal store table in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Adobe Acrobat Reader DC version 21.007.20095 (and earlier) 21.007.20096 (and earlier) 20.004.30015 (and earlier) and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Acrobat Reader DC version 21.007.20095 (and earlier) 21.007.20096 (and earlier) 20.004.30015 (and earlier) and 17.011.30202 (and earlier) is affected by a use-after-free that allow a remote attacker to disclose sensitive information on affected installations of of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG2000 images.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm listbox that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForm field that could result in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.


Use-after-free vulnerability in the Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Vista does not properly handle connection resources when starting and stopping processes which allows local users to gain privileges by opening and closing multiple ApiPort connections which leaves a \dangling pointer\ to a process data structure.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615 MDM9625 MDM9635M SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 615/16/SD 415 SD 800 SD 808 and SD 810 use after free vulnerability when the PDN throttle info block is freed without clearing the corresponding active timer.


Use-after-free

vulnerability

in

the

WebSocketDispatcherHost::SendOrDrop

function

in

in

the

Web

Sockets

implementation

in

Google

Chrome

before

might

allow

remote

attackers

to

bypass

the

sandbox

protection

mechanism

by

leveraging

an

incorrect

deletion

in

a

certain

failure

case.


A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.


Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced a user to enage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.


A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.


Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.


Acrobat Acrobat Pro DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Framemaker versions 2029u8 (and earlier) and 2020u4 (and earlier) are affected by a Use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of annotations that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the collab object that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of Annotation objects that could result in a memory leak in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Adobe Photoshop versions 22.5.6 (and earlier)and 23.2.2 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Pro DC version 22.001.2011x (and earlier) 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Acrobat Reader DC versions 20.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A use after free vulnerability was discovered in PDFTron SDK version 9.2.0. A crafted PDF can overwrite RIP with data previously allocated on the heap. This issue affects: PDFTron PDFTron SDK 9.2.0 on OSX; 9.2.0 on Linux; 9.2.0 on Windows.


Acrobat Reader DC versions 20.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Wasmtime is a standalone JIT-style runtime for WebAssembly using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected. The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order rather than block emission order. When Wasmtime would eventually collect garbage it would fail to find live references on the stack because of the missing stack maps think that they were unreferenced garbage and therefore reclaim them. Then after the collection ended the Wasm code could use the reclaimed-too-early references which is a use after free. Patches have been released in versions 0.34.2 and 0.35.2 which fix the vulnerability. All Wasmtime users are recommended to upgrade to these patched versions. If upgrading is not an option for you at this time you can avoid the vulnerability by either: disabling the Wasm reference types proposal config.wasm_reference_types(false); or by disabling epoch interruption if you were previously enabling it. config.epoch_interruption(false).


An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.


Acrobat Reader DC versions 22.001.20085 (and earlier) 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of fonts that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a use after free behavior when decoding PNG images. After `png::CommonFreeDecode(&decode)` gets called the values of `decode.width` and `decode.height` are in an unspecified state. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 TensorFlow 2.6.3 and TensorFlow 2.5.3 as these are also affected and still in supported range.


Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular when cleaning up after the guest's use of the device. In the case where an interrupt is not quiescent yet at the time this cleanup gets invoked the cleanup attempt may be scheduled to be retried. When multiple interrupts are involved this scheduling of a retry may get erroneously skipped. At the same time pointers may get cleared (resulting in a de-reference of NULL) and freed (resulting in a use-after-free) while other code would continue to assume them to be valid.


Use-after-free vulnerability in the fasync_helper function in fs/fcntl.c in the Linux kernel before 2.6.33-rc4-git1 allows local users to gain privileges via vectors that include enabling O_ASYNC (aka FASYNC or FIOASYNC) on a locked file and then closing this file.


ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data related to the zval_get_type function in Zend/zend_types.h. Exploitation of this issue can have an unspecified impact on the integrity of PHP.


The bfd_cache_close function in bfd/cache.c in the Binary File Descriptor (BFD) library (aka libbfd) as distributed in GNU Binutils 2.29 and earlier allows remote attackers to cause a heap use after free and possibly achieve code execution via a crafted nested archive file. This issue occurs because incorrect functions are called during an attempt to release memory. The issue can be addressed by better input validation in the bfd_generic_archive_p function in bfd/archive.c.


ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.


In the onQueueFilled function of SoftAVCDec there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-66969349.


In the enableVSyncInjections function of SurfaceFlinger there is a possible use after free of mVSyncInjector. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0 8.1. Android ID: A-65483324.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the core of the XFA engine. Successful exploitation could lead to arbitrary code execution.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the coresight-tmc driver a simultaneous read and enable of the ETR device after changing the buffer size may result in a Use After Free condition of the previous buffer.


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in the function mdss_rotator_ioctl in the driver /dev/mdss_rotator a Use-After-Free condition can potentially occur due to a fence being installed too early.


An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable use-after-free vulnerability exists. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability when processing Enhanced Metafile Format (EMF) data related to brush manipulation. Successful exploitation could lead to arbitrary code execution.


In Qualcomm Android for MSM Firefox OS for MSM and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05 if cmd_pkt and reg_pkt are called from different userspace threads a use after free condition can potentially occur in wdsp_glink_write().


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the Acrobat/Reader's JavaScript engine. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA rendering engine. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability when generating content using XFA layout engine. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA layout engine. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in Acrobat/Reader rendering engine. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in XFA event management. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the image conversion engine when decompressing JPEG data. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine related to manipulation of the navigation pane. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable use after free vulnerability in the JavaScript engine related to collaboration functionality. Successful exploitation could lead to arbitrary code execution.


A use-after-free vulnerability exists in the .ISO parsing functionality of PowerISO 6.8. A specially crafted .ISO file can cause a vulnerability resulting in potential code execution. An attacker can send a specific .ISO file to trigger this vulnerability.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine related to sub-form functionality. Successful exploitation could lead to arbitrary code execution.


An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine related to validation functionality. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable use after free vulnerability in the XFA engine related to layout functionality. Successful exploitation could lead to arbitrary code execution.


BIND was improperly sequencing cleanup operations on upstream recursion fetch contexts leading in some cases to a use-after-free error that can trigger an assertion failure and crash in named. Affects BIND 9.0.0 to 9.8.x 9.9.0 to 9.9.11 9.10.0 to 9.10.6 9.11.0 to 9.11.2 9.9.3-S1 to 9.9.11-S1 9.10.5-S1 to 9.10.6-S1 9.12.0a1 to 9.12.0rc1.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability in the JavaScript engine's annotation-related API. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability in XML Forms Architecture (XFA) related to reset form functionality. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability in the JavaScript API related to the collaboration functionality. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability in the XML Forms Architecture (XFA) engine. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in JavaScript engine when creating large strings. Successful exploitation could lead to arbitrary code execution.


Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to an interaction between the privacy user interface and the ActionScript 2 Camera object. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader 2017.009.20058 and earlier 2017.008.30051 and earlier 2015.006.30306 and earlier and 11.0.20 and earlier has an exploitable use after free vulnerability in the XFA parsing engine when handling certain types of internal instructions. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability when manipulating an internal data structure. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat Reader versions 11.0.19 and earlier 15.006.30280 and earlier 15.023.20070 and earlier have an exploitable use after free vulnerability in the XFA module related to the choiceList element. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Irssi before 1.0.4. While updating the internal nick list Irssi could incorrectly use the GHashTable interface and free the nick while updating it. This would then result in use-after-free conditions on each access of the hash table.


A use-after-free in RenderFreetype in MagickCore/annotate.c in ImageMagick 7.0.7-4 Q16 allows attackers to crash the application via a crafted font file because the FT_Done_Glyph function (from FreeType 2) is called at an incorrect place in the ImageMagick code.


While the IPA driver in Android for MSM Firefox OS for MSM and QRD Android before 2017-08-31 is processing IOCTL commands there is no mutex lock of allocated memory. If one thread sends an ioctl cmd IPA_IOC_QUERY_RT_TBL_INDEX while another sends an ioctl cmd IPA_IOC_DEL_RT_RULE a use-after-free condition may occur.


An exploitable use-after-free vulnerability exists in the JavaScript engine of Foxit Software's Foxit PDF Reader version 8.3.2.25013. A specially crafted PDF document can trigger a previously freed object in memory to be reused resulting in arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. If the browser plugin extension is enabled visiting a malicious site can also trigger the vulnerability.


The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions which allows remote attackers to conduct use-after-free attacks via a crafted file related to a ReadMNGImage out-of-order CloseBlob call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-11403.


A use-after-free vulnerability during video control operations when a \<track>\ element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


In all Qualcomm products with Android releases from CAF using the Linux kernel in function __mdss_fb_copy_destscaler_data() variable ds_datai.scale may still point to a user-provided address (which could point to arbitrary kernel address) so on an error condition this user-provided address will be freed (arbitrary free) and continued operation could result in use after free condition.


A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


A use-after-free vulnerability can occur when manipulating arrays of Accessible Rich Internet Applications (ARIA) elements within containers through the DOM. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disconnection operation is finished. This results in an exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


A use-after-free vulnerability can occur in the Fetch API when the worker or the associated window are freed when still in use resulting in a potentially exploitable crash. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


During TLS 1.2 exchanges handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases the handshake transcript can exceed the space available in the current buffer causing the allocation of a new buffer. This leaves a pointer pointing to the old freed buffer resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A use-after-free vulnerability can occur in design mode when image objects are resized if objects referenced during the resizing have been freed from memory. This results in a potentially exploitable crash. This vulnerability affects Firefox < 56 Firefox ESR < 52.4 and Thunderbird < 52.4.


A use-after-free vulnerability can occur when flushing and resizing layout because the \PressShell\ object has been freed while still in use. This results in a potentially exploitable crash during these operations. This vulnerability affects Firefox < 57 Firefox ESR < 52.5 and Thunderbird < 52.5.


A use-after-free vulnerability can occur while re-computing layout for a \marquee\ element during window resizing where the updated style object is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.3 Firefox ESR < 52.3 and Firefox < 55.


NVIDIA driver contains a vulnerability where it is possible a use after free malfunction can occur due to improper usage of the list_for_each kernel macro which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android ID: A-38046353. References: N-CVE-2017-6263.


readelf in GNU Binutils 2.28 has a use-after-free (specifically read-after-free) error while processing multiple relocated sections in an MSP430 binary. This is caused by mishandling of an invalid symbol index and mishandling of state across invocations.


NVIDIA mediaserver contains a vulnerability where it is possible a use after free malfunction can occur due to an incorrect bounds check which could enable unauthorized code execution and possibly lead to elevation of privileges. This issue is rated as high. Product: Android. Version: N/A. Android: A-63802421. References: N-CVE-2017-6276.


A use-after-free flaw was found in fs/userfaultfd.c in the Linux kernel before 4.13.6. The issue is related to the handling of fork failure when dealing with event messages. Failure to fork correctly can lead to a situation where a fork event will be removed from an already freed list of events with userfaultfd_ctx_put().


A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


Huawei Mate 9 Pro mobile phones with software of versions earlier than LON-AL00BC00B235 have a use after free (UAF) vulnerability. An attacker tricks a user into installing a malicious application and the application can riggers access memory after free it. A local attacker may exploit this vulnerability to cause the mobile phone to crash.


The mm_init function in kernel/fork.c in the Linux kernel before 4.12.10 does not clear the ->exe_file member of a new process's mm_struct allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program.


The init_new_context function in arch/x86/include/asm/mmu_context.h in the Linux kernel before 4.12.10 does not correctly handle errors from LDT table allocation when forking a new process allowing a local attacker to achieve a use-after-free or possibly have unspecified other impact by running a specially crafted program. This vulnerability only affected kernels built with CONFIG_MODIFY_LDT_SYSCALL=y.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JavaScript engine. The mismatch between an old and a new object can provide an attacker with unintended memory access. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the MakeAccessible plugin when creating an internal data structure. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JavaScript API engine. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JavaScript engine API. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions 2017.011.30066 and earlier versions 2015.006.30355 and earlier versions and 11.0.22 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the JavaScript engine. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption control-flow hijack or an information leak attack. Successful exploitation could lead to arbitrary code execution.


A use after free in PDFium in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52 Firefox ESR < 45.8 Thunderbird < 52 and Thunderbird < 45.8.


A use after free in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54 Firefox ESR < 52.2 and Thunderbird < 52.2.


A use after free in Blink in Google Chrome prior to 57.0.2987.133 for Linux Windows and Mac and 57.0.2987.132 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted PDF file.


A use-after-free can occur during buffer storage operations within the ANGLE graphics library used for WebGL content. The buffer storage can be freed while still in use in some circumstances leading to a potentially exploitable crash. Note: This issue is in \libGLES\ which is only in use on Windows. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.


A use after free in Chrome Apps in Google Chrome prior to 58.0.3029.81 for Mac Windows and Linux and 58.0.3029.83 for Android allowed a remote attacker to potentially perform out of bounds memory access via a crafted Chrome extension.


A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac Windows and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.


A use after free in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in Blink in Google Chrome prior to 59.0.3071.104 for Mac Windows and Linux and 59.0.3071.117 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page aka an IndexedDB sandbox escape.


A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux Android Windows and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


A use after free in printing in Google Chrome prior to 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in Apps in Google Chrome prior to 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in WebAudio in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


When adding a range to an object in the DOM it is possible to use \addRange\ to add the range to an incorrect root object. This triggers a use-after-free resulting in a potentially exploitable crash. This vulnerability affects Firefox < 52 and Thunderbird < 52.


A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page related to Bluetooth.


A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac Windows Linux and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use-after-free can occur when events are fired for a \FontFace\ object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52 Firefox ESR < 45.8 Thunderbird < 52 and Thunderbird < 45.8.


A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


A use after free in credit card autofill in Google Chrome prior to 59.0.3071.86 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.


A use after free in PrintPreview in Google Chrome prior to 58.0.3029.81 for Windows allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.


A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1 Firefox ESR < 45.9 Firefox ESR < 52.1 and Firefox < 53.


A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac Windows and Linux and 57.0.2987.108 for Android allowed a remote attacker to have an unspecified impact via a crafted PDF file.


Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has been freed. Line 542 of gravity_lexer.c. 'lexer' is being used to access a variable but 'lexer' has already been freed creating a Heap Use-After-Free condition.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W SD 210/SD 212/SD 205 SD 450 SD 615/16/SD 415 SD 625 SD 650/52 SD 820 SD 835 SD 845 while processing the retransmission of WPA supplicant command send failures there is a make after break of the connection to WPA supplicant where the local pointer is not properly updated. If the WPA supplicant command transmission fails a Use After Free condition will occur.


In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile Snapdragon Mobile and Snapdragon Wear MDM9206 MDM9607 MDM9650 MSM8909W SD 210/SD 212/SD 205 SD 400 SD 425 SD 430 SD 450 SD 615/16/SD 415 SD 617 SD 625 SD 650/52 SD 808 SD 810 SD 820 SD 820A SD 835 SD 845 when processing a call disconnection there is an attempt to print the RIL token-id to the debug log. If eMBMS service is enabled while processing the call disconnect a Use After Free condition may potentially occur.


In

Android

before

security

patch

level

on

Qualcomm

Snapdragon

Automobile

Snapdragon

Mobile

and

Snapdragon

Wear

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD

in

the

omx

aac

component

a

Use

After

Free

condition

may

potentially

occur.


Use

after

free

in

QSH

client

rule

processing

in

snapdragon

mobile

and

snapdragon

wear

in

versions

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


A

Use

After

Free

Condition

can

occur

in

Thermal

Engine

in

Snapdragon

Automobile

Snapdragon

Mobile

Snapdragon

Wear

in

SD

SD

SD

SD

SD

SD

SD

SD

SD

SD


Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file or if httpd.conf has certain misconfigurations aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.