The Zone::New function in zone.cc in Google V8 before 5.0.71.47, as used in Google Chrome before 50.0.2661.102, does not properly determine when to expand certain memory allocations, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted JavaScript code.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:0002 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    The following packages have been upgraded to a newer upstream version: rh-nodejs4-nodejs (4.6.2), rh-     nodejs4-http-parser (2.7.0). (BZ#1388097)

    Security Fix(es):

    * It was found that Node.js' tls.checkServerIdentity() function did not properly validate server     certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted     certificate accepted by a Node.js TLS client. (CVE-2016-7099)

    * It was found that the V8 Zone class was vulnerable to integer overflow when allocating new memory     (Zone::New() and Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash     the application or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)

    * A vulnerability was found in c-ares, a DNS resolver library bundled with Node.js. A hostname with an     escaped trailing dot would have its size calculated incorrectly, leading to a single byte written beyond     the end of a buffer on the heap. An attacker able to provide such a hostname to an application using     c-ares, could potentially cause that application to crash. (CVE-2016-5180)

    * It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote     attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted     HTTP request. (CVE-2016-5325)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2017:0880 advisory.

    V8 is Google's open source JavaScript engine. V8 is written in C++ and is used in Google Chrome, the open     source browser from Google. V8 implements ECMAScript as specified in ECMA-262, 3rd edition.

    Security Fix(es):

    * An integer-overflow flaw was found in V8's Zone class when allocating new memory (Zone::New() and     Zone::NewExpand()). An attacker with the ability to manipulate a large zone could crash the application     or, potentially, execute arbitrary code with the application privileges. (CVE-2016-1669)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - v8: IPC and v8 issue fixed in Google Chrome 38.0.2125.101 (CVE-2014-3188)

  - V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

  - Google V8, as used in Google Chrome before 38.0.2125.101, does not properly track JavaScript heap-memory     allocations as allocations of uninitialized memory and does not properly concatenate arrays of double-     precision floating-point numbers, which allows remote attackers to obtain sensitive information via     crafted JavaScript code, related to the PagedSpace::AllocateRaw and NewSpace::AllocateRaw functions in     heap/spaces-inl.h, the LargeObjectSpace::AllocateRaw function in heap/spaces.cc, and the     Runtime_ArrayConcat function in runtime.cc. (CVE-2014-3195)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0336 advisory.

    Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning,     remote management, and monitoring of multiple Linux deployments with a single centralized tool.

    This update provides Satellite 6.3 packages for Red Hat Enterprise Linux 7 Satellite server. For the full     list of new features provided by Satellite 6.3, see the Release Notes linked to in the references section.
    See the Satellite 6 Installation Guide for detailed instructions on how to install a new Satellite 6.3     environment, or the Satellite 6 Upgrading and Updating guide for detailed instructions on how to upgrade     from prior versions of Satellite 6.

    All users who require Satellite version 6.3 are advised to install these new packages.

    Security Fix(es):

    * V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

    * rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)

    * foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to     that Organization (CVE-2014-8183)

    * foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)

    * pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)

    * foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)

    * foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)

    * foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)

    * foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)

    * katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)

    * rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

    * foreman: Image password leak (CVE-2017-2672)

    * pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)

    * foreman: Information disclosure in provisioning template previews (CVE-2016-4995)

    * foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Randy Barlow (RedHat) for reporting CVE-2016-3704 and Sander Bos for reporting     CVE-2016-3696. The CVE-2014-8183 issue was discovered by Eric Helms (Red Hat); the CVE-2016-3693 and     CVE-2016-4995 issues were discovered by Dominic Cleal (Red Hat); the CVE-2016-4451 and CVE-2016-6319     issues were discovered by Marek Huln (Red Hat); the CVE-2016-4996 issue was discovered by Thom Carlin     (Red Hat); the CVE-2016-8639 issue was discovered by Sanket Jagtap (Red Hat); the CVE-2016-9595 issue was     discovered by Evgeni Golov (Red Hat); the CVE-2017-2667 issue was discovered by Tomas Strachota (Red Hat);
    and the CVE-2016-9593 issue was discovered by Pavel Moravec (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 8.1. It is, therefore, affected by multiple remote code execution vulnerabilities in the Node.js component of the Xcode Server. An unauthenticated, remote attacker can exploit these vulnerabilities to cause a denial of service condition or the execution of arbitrary code.

This update brings the new upstream nodejs LTS version 4.6.0, fixing bugs and security issues :

  - Nodejs embedded openssl version update

  + upgrade to 1.0.2j (CVE-2016-6304, CVE-2016-2183,     CVE-2016-2178, CVE-2016-6306, CVE-2016-7052)

  + remove support for dynamic 3rd party engine modules

- http: Properly validate for allowable characters in input user data. This introduces a new case where throw may occur when configuring HTTP responses, users should already be adopting try/catch here.
  (CVE-2016-5325, bsc#985201)

  - tls: properly validate wildcard certificates     (CVE-2016-7099, bsc#1001652)

  - buffer: Zero-fill excess bytes in new Buffer objects     created with Buffer.concat()

fix for CVE-2016-1669, fix for builtin reporting, add provides for v8-314

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs fixes the following issue :

  - CVE-2016-1669 :

  - fix buffer overflow in v8 (boo#987919)

Chromium was updated to 51.0.2704.103 to fix three vulnerabilities :

  - CVE-2016-1704: Various fixes from internal audits,     fuzzing and other initiatives (shared identifier)     (boo#985397)

Includes vulnerability fixes from 50.0.2661.102 (boo#979859) :

  - CVE-2016-1667: Same origin bypass in DOM

  - CVE-2016-1668: Same origin bypass in Blink V8 bindings

  - CVE-2016-1669: Buffer overflow in V8

  - CVE-2016-1670: Race condition in loader

Includes vulnerability fixes from 50.0.2661.94 (boo#977830) :

  - CVE-2016-1660: Out-of-bounds write in Blink

  - CVE-2016-1661: Memory corruption in cross-process frames

  - CVE-2016-1662: Use-after-free in extensions

  - CVE-2016-1663: Use-after-free in Blink&rsquo;s V8     bindings

  - CVE-2016-1664: Address bar spoofing

  - CVE-2016-1665: Information leak in V8

  - CVE-2016-1666: Various fixes from internal audits,     fuzzing and other initiatives

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1667     Mariusz Mylinski discovered a cross-origin bypass.

  - CVE-2016-1668     Mariusz Mylinski discovered a cross-origin bypass in     bindings to v8.

  - CVE-2016-1669     Choongwoo Han discovered a buffer overflow in the v8     JavaScript library.

  - CVE-2016-1670     A race condition was found that could cause the renderer     process to reuse ids that should have been unique.

  - CVE-2016-1672     Mariusz Mylinski discovered a cross-origin bypass in     extension bindings.

  - CVE-2016-1673     Mariusz Mylinski discovered a cross-origin bypass in     Blink/Webkit.

  - CVE-2016-1674     Mariusz Mylinski discovered another cross-origin bypass     in extension bindings.

  - CVE-2016-1675     Mariusz Mylinski discovered another cross-origin bypass     in Blink/Webkit.

  - CVE-2016-1676     Rob Wu discovered a cross-origin bypass in extension     bindings.

  - CVE-2016-1677     Guang Gong discovered a type confusion issue in the v8     JavaScript library.

  - CVE-2016-1678     Christian Holler discovered an overflow issue in the v8     JavaScript library.

  - CVE-2016-1679     Rob Wu discovered a use-after-free issue in the bindings     to v8.

  - CVE-2016-1680     Atte Kettunen discovered a use-after-free issue in the     skia library.

  - CVE-2016-1681     Aleksandar Nikolic discovered an overflow issue in the     pdfium library.

  - CVE-2016-1682     KingstonTime discovered a way to bypass the Content     Security Policy.

  - CVE-2016-1683     Nicolas Gregoire discovered an out-of-bounds write issue     in the libxslt library.

  - CVE-2016-1684     Nicolas Gregoire discovered an integer overflow issue in     the libxslt library.

  - CVE-2016-1685     Ke Liu discovered an out-of-bounds read issue in the     pdfium library.

  - CVE-2016-1686     Ke Liu discovered another out-of-bounds read issue in     the pdfium library.

  - CVE-2016-1687     Rob Wu discovered an information leak in the handling of     extensions.

  - CVE-2016-1688     Max Korenko discovered an out-of-bounds read issue in     the v8 JavaScript library.

  - CVE-2016-1689     Rob Wu discovered a buffer overflow issue.

  - CVE-2016-1690     Rob Wu discovered a use-after-free issue.

  - CVE-2016-1691     Atte Kettunen discovered a buffer overflow issue in the     skia library.

  - CVE-2016-1692     Til Jasper Ullrich discovered a cross-origin bypass     issue.

  - CVE-2016-1693     Khalil Zhani discovered that the Software Removal Tool     download was done over an HTTP connection.

  - CVE-2016-1694     Ryan Lester and Bryant Zadegan discovered that pinned     public keys would be removed when clearing the browser     cache.

  - CVE-2016-1695     The chrome development team found and fixed various     issues during internal auditing.

Google Chrome Releases reports :

5 security fixes in this release, including :

- [605766] High CVE-2016-1667: Same origin bypass in DOM. Credit to Mariusz Mlynski.

- [605910] High CVE-2016-1668: Same origin bypass in Blink V8 bindings. Credit to Mariusz Mlynski.

- [606115] High CVE-2016-1669: Buffer overflow in V8. Credit to Choongwoo Han.

- [578882] Medium CVE-2016-1670: Race condition in loader. Credit to anonymous.

- [586657] Medium CVE-2016-1671: Directory traversal using the file scheme on Android. Credit to Jann Horn.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2960-1 advisory.

    An out of bounds write was discovered in Blink. If a user were tricked in to opening a specially crafted     website, an attacker could potentially exploit this to cause a denial of service via renderer crash, or     execute arbitrary code. (CVE-2016-1660)

    It was discovered that Blink assumes that a frame which passes same-origin checks is local in some cases.
    If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit     this to cause a denial of service via renderer crash, or execute arbitrary code. (CVE-2016-1661)

    A use-after-free was discovered in the V8 bindings in Blink. If a user were tricked in to opening a     specially crafted website, an attacker could potentially exploit this to cause a denial of service via     renderer crash, or execute arbitrary code. (CVE-2016-1663)

    It was discovered that the JSGenericLowering class in V8 mishandles comparison operators. If a user were     tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain     sensitive information. (CVE-2016-1665)

    Multiple security issues were discovered in Chromium. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to read uninitialized memory, cause a denial     of service via application crash or execute arbitrary code. (CVE-2016-1666)

    It was discovered that the TreeScope::adoptIfNeeded function in Blink does not prevent script execution     during node-adoption operations. If a user were tricked in to opening a specially crafted website, an     attacker could potentially exploit this to bypass same origin restrictions. (CVE-2016-1667)

    It was discovered that the forEachForBinding in the V8 bindings in Blink uses an improper creation     context. If a user were tricked in to opening a specially crafted website, an attacker could potentially     exploit this to bypass same origin restrictions. (CVE-2016-1668)

    A buffer overflow was discovered in V8. If a user were tricked in to opening a specially crafted website,     an attacker could potentially exploit this to cause a denial of service via renderer crash, or execute     arbitrary code. (CVE-2016-1669)

    A race condition was discovered in ResourceDispatcherHostImpl in Chromium. An attacker could potentially     exploit this to make arbitrary HTTP requests. (CVE-2016-1670)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Chromium was updated to 50.0.2661.102 to fix four vulnerabilities (boo#979859) :

  - CVE-2016-1667: Same origin bypass in DOM

  - CVE-2016-1668: Same origin bypass in Blink V8 bindings

  - CVE-2016-1669: Buffer overflow in V8

  - CVE-2016-1670: Race condition in loader

The remote host is affected by the vulnerability described in GLSA-201605-02 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Chromium is an open source web browser, powered by WebKit (Blink).

This update upgrades Chromium to version 50.0.2661.102.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. (CVE-2016-1667, CVE-2016-1668, CVE-2016-1669, CVE-2016-1670)

The version of Google Chrome installed on the remote Mac OS X host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

ID	Name	Product	Family	Severity
210197	RHEL 6 / 7 : rh-nodejs4-nodejs and rh-nodejs4-http-parser (RHSA-2017:0002)	Nessus	Red Hat Local Security Checks	critical
210151	RHEL 7 : v8 (RHSA-2017:0880)	Nessus	Red Hat Local Security Checks	high
198942	RHEL 6 : v8 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198875	RHEL 7 : v8 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196869	RHEL 6 : v8 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196769	RHEL 7 : v8 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
107053	RHEL 7 : Satellite 6.3 (RHSA-2018:0336)	Nessus	Red Hat Local Security Checks	high
94935	Apple Xcode < 8.1 Node.js Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	critical
94002	openSUSE Security Update : nodejs (openSUSE-2016-1172)	Nessus	SuSE Local Security Checks	high
92830	Fedora 23 : 1:v8 (2016-6fd3131c03)	Nessus	Fedora Local Security Checks	high
92812	Fedora 24 : 1:v8 (2016-e720bc8451)	Nessus	Fedora Local Security Checks	high
92488	openSUSE Security Update : nodejs (openSUSE-2016-884)	Nessus	SuSE Local Security Checks	high
91848	openSUSE Security Update : Chromium (openSUSE-2016-756)	Nessus	SuSE Local Security Checks	critical
91429	Debian DSA-3590-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	high
91371	FreeBSD : chromium -- multiple vulnerabilities (4dfafa16-24ba-11e6-bd31-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	high
91257	Ubuntu 14.04 LTS / 16.04 LTS : Oxide vulnerabilities (USN-2960-1)	Nessus	Ubuntu Local Security Checks	critical
91177	openSUSE Security Update : Chromium (openSUSE-2016-584)	Nessus	SuSE Local Security Checks	high
91176	GLSA-201605-02 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91157	RHEL 6 : chromium-browser (RHSA-2016:1080)	Nessus	Red Hat Local Security Checks	high
91129	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
91128	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2016-1669

high

Tenable Plugins

critical

high

high

high

high

high

high

critical

high

high

high

high

critical

high

high

critical

high

critical

high

critical

critical