Open Source Vulnerabilities

webkit2gtk

use after free issue was addressed with improved memory management

librewolf, librewolf, librewolf, librewolf, librewolf

By utilizing 3D CSS in conjunction with Javascript, content could have been rendered outside the webpage's viewport, resulting in a spoofing attack that could have been used for phishing or other a...

ppp

eap

nodejs-23, nodejs-current, nodejs18, nodejs18

Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons

rssh

Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the ...

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

When Responsive Design Mode was enabled, it used references to objects that were previously freed

webkit2gtk

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER

ppp

vulnerability classified as problematic has been found in ppp

nodejs-23, nodejs-current, nodejs18, nodejs18

napi_get_value_string_*() allows various kinds of memory corruption in node < 10

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write

webkit2gtk

In WebKitGTK through 2

nodejs-23, nodejs-current, nodejs18, nodejs18

In nghttp2 before version 1

librewolf, librewolf, librewolf, librewolf, librewolf

When Web Render components were destructed, a race condition could have caused undefined behavior, and we presume that with enough effort may have been exploitable to run arbitrary code

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

webkit2gtk-6.0, webkit2gtk

Windows Common Log File System Driver Denial of Service Vulnerability

nodejs-23, nodejs-current, nodejs18, nodejs18

TLS session reuse can lead to host certificate verification bypass in node version < 12

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 88 and Firefox ESR 78

webkit2gtk-6.0, webkit2gtk

logic issue in the handling of concurrent media was addressed with improved state handling

libuv, nodejs-23, nodejs18, nodejs18

implementation of realpath in libuv < 10

hylafax

HylaFAX 6

librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 88

webkit2gtk-6.0, webkit2gtk

issue was addressed with improved UI handling

librewolf, librewolf, librewolf, librewolf, librewolf

malicious website that causes an HTTP Authentication dialog to be spawned could trick the built-in password manager to suggest passwords for the currently active website instead of the website that...

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

libssh2

flaw was found in libssh2 before 1

webkit2gtk-6.0, webkit2gtk

out-of-bounds write issue was addressed with improved input validation

librewolf, librewolf, librewolf, librewolf, librewolf

Address bar search suggestions in private browsing mode were re-using session data from normal mode

libssh2

out of bounds read flaw was discovered in libssh2 before 1

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

librewolf, librewolf, librewolf, librewolf, librewolf

Firefox for Android would become unstable and hard-to-recover when a website opened too many popups

libssh2

out of bounds read flaw was discovered in libssh2 before 1

librewolf, librewolf, librewolf, librewolf, librewolf

When styling and rendering an oversized `<select>` element, Firefox did not apply correct clipping which allowed an attacker to paint over the user interface

ipmitool

It's been found that multiple functions in ipmitool before 1

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

libssh2

out of bounds read flaw was discovered in libssh2 before 1

librewolf, librewolf, librewolf, librewolf, librewolf

Firefox used to cache the last filename used for printing a file

xrdp

xrdp-sesman service before version 0

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

libssh2

out of bounds read flaw was discovered in libssh2 before 1

librewolf, librewolf, librewolf, librewolf, librewolf

When a user has already allowed a website to access microphone and camera, disabling camera sharing would not fully prevent the website from re-enabling it without an additional prompt

xrdp

In the xrdp package (in branches through 3

libssh2

out of bounds read flaw was discovered in libssh2 before 1

chrony

flaw was found in chrony versions before 3

nodejs-23, qt5-qtwebengine, nodejs18, nodejs18

Heap buffer overflow in V8 in Google Chrome prior to 88

librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 89

libssh2

integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1

xrdp

xrdp is an open source remote desktop protocol (RDP) server

WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes

nikto

CSV Injection vulnerability in Nikto 2

nodejs-23, nodejs-current, nodejs18, nodejs18

Node