Regenrecht

The issue allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. This occurs due to a use-after-free vulnerability in DirectionalityUtils.cpp.

The issue is related to a use-after-free vulnerability in the `obj toSource` function. This vulnerability allows remote attackers to execute arbitrary code via a crafted web page that references JavaScript Proxy objects not properly handled during garbage collection.

The issue is related to a use-after-free vulnerability in the mozVibrate implementation in the Vibrate library. This allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.

The issue allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects. This is related to a use-after-free vulnerability in the ListenerManager implementation.

The issue is related to a use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component. This allows remote attackers to execute arbitrary code via crafted web content.

The issue is related to a use-after-free vulnerability in the `nsHTMLSelectElement` function. This vulnerability allows remote attackers to execute arbitrary code via vectors involving removal of the parent node of an element.

The issue arises from the improper handling of SVG text by the `SVGTextElement.getCharNumAtPosition` function, allowing remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."

The issue is related to a use-after-free vulnerability in the implementation of SVG element lists, specifically in the nsSVGPointList::AppendElement function. This vulnerability can be exploited by remote attackers to cause a denial of service, resulting in an application crash, or possibly to execute arbitrary code. The exploitation involves vectors with a user-supplied callback.

The issue allows remote attackers to execute arbitrary code via a crafted XUL document that dequeues the current command updater, leveraging a use-after-free vulnerability in the nsXULCommandDispatcher function.

The issue allows remote attackers to execute arbitrary code via vectors related to OBJECT's `mObserverList`. This is a use-after-free vulnerability.

The issue is related to the improper use of nsTreeRange data structures, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "dangling pointer."

The issue is related to an integer overflow in the NewIdArray function, which allows remote attackers to execute arbitrary code via a JavaScript array with many elements.

The issue involves a use-after-free vulnerability that can be exploited by remote attackers to execute arbitrary code. This is achieved through vectors involving a change to an `nsDOMAttribute` node.

The issue arises from the LookupGetterOrSetter function in js3250.dll, which does not properly handle `window. lookupGetter ` function calls without arguments. This can be exploited by remote attackers to execute arbitrary code or cause a denial of service through incorrect pointer dereference and application crash, involving a "dangling pointer" and the `JS ValueToId` function.

The issue is related to a dangling pointer vulnerability, where the nsTreeContentView function does not properly handle node removal in XUL trees. This allows remote attackers to execute arbitrary code via vectors involving access to deleted memory.

The issue is related to a use-after-free vulnerability in the `nsTreeSelection` function, which might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection. This is due to a "dangling pointer vulnerability" and is a result of an incomplete fix for a previous issue.

A use-after-free issue in the attribute-cloning functionality of the DOM implementation allows remote attackers to execute arbitrary code via vectors related to deletion of an event attribute node with a nonzero reference count.

A use-after-free issue in the NodeIterator implementation allows remote attackers to execute arbitrary code via a crafted NodeFilter that detaches DOM nodes, related to the NodeIterator interface and a javascript callback.

The issue is related to an integer overflow in the cgtexttops CUPS filter in Printing, which allows remote attackers to execute arbitrary code or cause a denial of service, such as an application crash, via vectors related to page sizes.

The issue is related to the WriteProlog function in texttops.c in the Text Filter subsystem, which does not check the return values of certain calloc calls. This allows remote attackers to cause a denial of service, such as a NULL pointer dereference or heap memory corruption, or possibly execute arbitrary code via a crafted file.