Open Source Vulnerabilities

qt5-qtwebengine, qt6-qtwebengine

Use after free in Canvas in Google Chrome prior to 121

mozjs115, thunderbird

During garbage collection extra operations were performed on a object that should not be

qt5-qtwebengine, qt6-qtwebengine

Use after free in Peer Connection in Google Chrome prior to 121

thunderbird

executable file warning was not presented when downloading

thunderbird

Security fix for CVE-2023-5726 applied in: thunderbird 115.4.1-r0

qt6-qtwebengine

Inappropriate implementation in Navigation in Google Chrome prior to 122

qt6-qtwebengine

Inappropriate implementation in Content Security Policy in Google Chrome prior to 122

thunderbird

malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive user data

libvpx, qt5-qtwebengine

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117

qt6-qtwebengine

Inappropriate implementation in Site Isolation in Google Chrome prior to 122

thunderbird

Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash

qt6-qtwebengine

Use after free in Mojo in Google Chrome prior to 122

vlc

Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4

thunderbird

attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited

thunderbird

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient activation-delay

vlc

exploitable denial-of-service vulnerability exists in the resource allocation handling of Videolabs libmicrodns 0

libxml2, qt6-qtwebengine

issue was discovered in libxml2 before 2

thunderbird

Memory safety bugs present in Firefox 119, Firefox ESR 115

vlc

exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0

qt5-qtwebengine, qt6-qtwebengine

vulnerability was found in SQLite SQLite3 up to 3

intel-ucode, intel-ucode

Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis

thunderbird

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/

plasma-workspace

KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5

vlc

exploitable denial-of-service vulnerability exists in the message-parsing functionality of Videolabs libmicrodns 0

intel-ucode, intel-ucode

Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel...

qt5-qtwebengine, qt6-qtwebengine

Heap buffer overflow in ANGLE in Google Chrome prior to 123

thunderbird

When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not unlike the clipboard

vlc

exploitable denial-of-service vulnerability exists in the TXT record-parsing functionality of Videolabs libmicrodns 0

qt6-qtwebengine

Out of bounds memory access in V8 in Google Chrome prior to 123

thunderbird

Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115

vlc

exploitable code execution vulnerability exists in the label-parsing functionality of Videolabs libmicrodns 0

intel-ucode, intel-ucode, intel-ucode, intel-ucode, intel-ucode, intel-ucode, xen, xen, xen

Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclo...

thunderbird

black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts

vlc

exploitable denial-of-service vulnerability exists in the resource record-parsing functionality of Videolabs libmicrodns 0

qt5-qtwebengine, qt6-qtwebengine

Out of bounds memory access in Compositing in Google Chrome prior to 123

thunderbird

It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash

vlc

off-by-one error in the DecodeBlock function in codec/sdl_image

fribidi

buffer overflow in the fribidi_get_par_embedding_levels_ex() function in lib/fribidi-bidi

qt6-qtwebengine

Type Confusion in WebAssembly in Google Chrome prior to 123

intel-ucode, intel-ucode, intel-ucode, intel-ucode, intel-ucode, intel-ucode, xen, xen, xen

TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access

thunderbird

On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the images created on the canvas element

vlc

heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal

qt6-qtwebengine

Out of bounds read in Swiftshader in Google Chrome prior to 123

fribidi

segmentation fault (SEGV) flaw was found in the Fribidi package and affects the fribidi_remove_bidi_marks() function of the lib/fribidi

kodi, kodi, kodi

Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17

thunderbird

Memory safety bug present in Firefox 124, Firefox ESR 115

qt6-qtwebengine

Object lifecycle issue in V8 in Google Chrome prior to 123

fribidi

heap-based buffer overflow flaw was found in the Fribidi package and affects the fribidi_cap_rtl_to_unicode() function of the fribidi-char-sets-cap-rtl

vlc

vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3

intel-ucode, intel-ucode

Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access