CVE Vulnerability Advisory Database

[Affected Scope] TrueConf Server versions 5.3.0 to 5.3.9, 5.4.0 to 5.4.9, 5.5.0 to 5.5.5, and earlier

[Impact] An unauthenticated remote attacker can bypass sandbox isolation and execute arbitrary code on the host system by sending a crafted script via TCP port 4307.

[Mitigation] Immediately upgrade TrueConf Server to the latest patched version and restrict network access to TCP port 4307 using firewalls.

[Affected Scope] Self-managed Grist deployments running versions prior to 1.7.9 with the GRIST_SANDBOX_FLAVOR environment variable configured to pyodide

[Impact] A remote attacker can execute arbitrary system processes on the hosting server by tricking a user into opening a maliciously crafted spreadsheet

[Mitigation] Upgrade Grist to version 1.7.9 or higher, or immediately change the sandbox flavor configuration to gvisor to enforce kernel-level isolation

[Affected Scope] Devices running iOS 15/16/17/18, iPadOS, macOS Sequoia, visionOS, watchOS, and Safari browser

[Impact] Processing maliciously crafted web content may allow an attacker to break out of the Web Content sandbox and execute arbitrary code, with active exploitation reported in targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple, including iOS 18.3.2 and macOS 15.3.2

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 125.0.6422.60

[Impact] A remote attacker can execute arbitrary code within the browser sandbox by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (125.0.6422.60 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 124.0.6367.201

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a crafted HTML page to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome to the latest stable version (124.0.6367.201 or higher) and enforce auto-update policies across the enterprise

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 119.0.6045.199

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a malicious file to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable channel (119.0.6045.199 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 112.0.5615.137

[Impact] A remote attacker who has compromised the renderer process can potentially perform a sandbox escape and execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (112.0.5615.137 or higher)

[Affected Scope] Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0

[Impact] Attackers can trigger a Use-After-Free (UAF) condition via crafted web content, leading to arbitrary code execution and a complete sandbox escape on the host OS

[Mitigation] Immediately update all affected Mozilla products to their respective patched versions (Firefox 97.0.2+, Firefox ESR 91.6.1+, Thunderbird 91.6.2+, etc.)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 107.0.5304.121

[Impact] A remote attacker who has compromised the renderer process can bypass the browser sandbox and potentially execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (107.0.5304.121 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 105.0.5195.102

[Impact] A remote attacker who has compromised the renderer process can bypass the browser sandbox and potentially execute arbitrary code on the host system via crafted Mojo IPC messages

[Mitigation] Immediately update Google Chrome and all Chromium-based browsers to version 105.0.5195.102 or later

[Affected Scope] Google Chrome prior to version 94.0.4606.61 on desktop platforms

[Impact] A remote attacker who has compromised the renderer process can potentially bypass the Chrome sandbox and execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.61 or higher) and enforce automatic updates across enterprise endpoints

[Affected Scope] Google Chrome prior to version 93.0.4577.82

[Impact] A remote attacker who has compromised the renderer process can potentially execute arbitrary code and escape the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (93.0.4577.82 or higher)

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.

[Affected Scope] Google Chrome prior to version 86.0.4240.198

[Impact] A remote attacker who has compromised the renderer process can bypass sandbox boundaries and potentially execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (86.0.4240.198 or higher)

[Affected Scope] Google Chrome for Android prior to version 86.0.4240.185

[Impact] A remote attacker who has compromised the renderer process can trigger a heap buffer overflow in the UI component via a crafted HTML page, potentially leading to a complete sandbox escape and arbitrary code execution on the target device

[Mitigation] Immediately update Google Chrome for Android to version 86.0.4240.185 or later via the Google Play Store

[Affected Scope] Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2

[Impact] Insufficient validation of IPC parameters passed from child to parent processes allows a compromised child process to bypass sandbox restrictions and trigger arbitrary web content loading in the non-sandboxed parent process.

[Mitigation] Immediately upgrade all affected installations to Firefox 67.0.4, Firefox ESR 60.7.2, or Thunderbird 60.7.2 or higher.

[Affected Scope] Elasticsearch versions before 1.3.8 and 1.4.x versions before 1.4.3

[Impact] Unauthenticated remote attackers can bypass sandbox restrictions to execute arbitrary shell commands on the host system, leading to complete system compromise

[Mitigation] Immediately upgrade Elasticsearch to version 1.3.8, 1.4.3, or later, or disable dynamic scripting in the configuration

[Affected Scope] Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows operating systems.

[Impact] Attackers can bypass the sandbox protection mechanism and execute arbitrary native code in a privileged context.

[Mitigation] Immediately upgrade affected installations to patched versions 10.1.11, 11.0.08, or later.

[Affected Scope] Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, 5.0 Update 45 and earlier, and OpenJDK 7.

[Impact] Remote attackers can completely bypass the Java security sandbox and execute arbitrary code on the host system via malicious 2D image rendering.

[Mitigation] Immediately upgrade to Java SE 7u25 or later, apply OpenJDK security patches, and disable Java browser plugins.

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.