Sajeeb Lohani

A heap-based buffer overflow exists in the web service that listens on TCP port 4443 by default. The issue occurs because the service fails to properly validate the length of user-supplied data before copying it to a heap-based buffer. A remote attacker can exploit this flaw without authentication to execute arbitrary code in the context of the service account.

A privilege escalation issue exists within the DOM: Content Processes component.

An integer overflow occurs in the `kiss fftndr alloc()` function within kiss fftndr.c. The allocation size calculation `dimOther*(dimReal+2)*sizeof(kiss fft scalar)` overflows signed 32-bit integer arithmetic before being widened to `size t`, leading to the allocation of an undersized buffer via `malloc()`. An attacker can trigger a heap buffer overflow by providing crafted dimensions that cause the multiplication to exceed `INT MAX`, enabling writes beyond the allocated buffer region when `kiss fftndr()` processes the data.

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149.0.2 Firefox ESR versions prior to 140.9.1 Thunderbird versions prior to 149.0.2 Thunderbird versions prior to 140.9.1 Description The software contains incorrect boundary conditions and an integer overflow within the Graphics: Text component. Recommendations Update Firefox to version 149.0.2 or later. Update Firefox ESR to version 140.9.1 or later. Update Thunderbird to version 149.0.2 or later. Update Thunderbird to version 140.9.1 or later.

A use-after-free condition exists in the DOM Core and HTML components. This issue could allow for unexpected behavior or potential compromise.

A flaw exists in Firefox and Thunderbird due to a use-after-free condition within the Disability Access APIs component, potentially allowing for a sandbox escape. This issue could allow an attacker to bypass security restrictions and gain unauthorized access.

An issue exists due to incorrect boundary conditions within the Audio/Video component.

The vulnerability stems from incorrect boundary conditions within the Graphics component.

An issue exists due to incorrect boundary conditions within the Audio/Video component.

The issue involves incorrect boundary conditions within the Graphics: Text component. This could potentially lead to unexpected behavior or instability.

The software contains memory safety bugs, some of which demonstrate evidence of memory corruption. It is presumed that, with sufficient effort, these bugs could potentially be exploited to execute arbitrary code.

alsa-lib contains a heap-based buffer overflow in the topology mixer control decoder. The `tplg decode control mixer1()` function reads the `num channels` field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array `SND TPLG MAX CHAN`. A crafted topology file with an excessive `num channels` value can cause out-of-bounds heap writes, leading to a crash.

A use-after-free issue exists in the JavaScript: WebAssembly component. This can potentially lead to unexpected behavior or allow for malicious actions.

A sandbox escape issue exists in the Storage: IndexedDB component. This allows a potential escape from the browser's security sandbox.

A use-after-free issue exists in the Storage: IndexedDB component. This can potentially lead to unexpected behavior or crashes.

A flaw exists due to incorrect boundary conditions within the Telemetry component of the software. This issue could allow for a sandbox escape.

A flaw exists that allows for a sandbox escape due to incorrect boundary conditions within the DOM Core & HTML component. This issue could potentially allow an attacker to bypass security restrictions.

The JavaScript Engine component contains an invalid pointer issue.

The Graphics: Canvas2D component contains incorrect boundary conditions. This issue may allow for unexpected behavior or potential security implications.

The Graphics: Canvas2D component contains incorrect boundary conditions. This issue may allow for unexpected behavior or potential security implications due to improper handling of boundaries within the Canvas2D functionality.