Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

netfilter: conntrack: remove sprintf usage

libceph: Fix potential out-of-bounds access in crush_decode()

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer

Sandbox escape in the Profile Backup component

Use-After-Free in SOAP using Apache map

Other issue in the WebRTC component

Incorrect boundary conditions in the Audio/Video: Playback component

Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()

Uninitialized memory in the Audio/Video: Web Codecs component

A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and Commit d20315b

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Mitigation bypass in the Networking: HTTP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the CSS Parsing and Computation component

Sandbox escape due to incorrect boundary conditions in the Networking component

Sandbox escape in the Security: Process Sandboxing component

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Workers component

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

Webkitgtk: use-after-free of jscvalue function parameters

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability

Use-after-free in the Networking: HTTP component

Privilege escalation in the Graphics: WebRender component

Gstreamer1-plugins-bad-free: gstreamer: heap buffer overflow via crafted vnc server rectangle in librfb

Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151

Privilege escalation in the Graphics: WebRender component

Incorrect boundary conditions, integer overflow in the Graphics: Text component

Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

Postgresql: extension script @substitutions@ within quoting allow sql injection

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

Libsoup: libsoup: heap buffer overflow during websocket client-frame masking

Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth