Use-after-free in the DOM: Networking component

libssh2 userauth.c userauth_password integer overflow

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

selinux: fix overlayfs mmap() and mprotect() access checks

Emacs: emacs: memory corruption vulnerability when processing svg css

Gimp: gimp: application crashes or information disclosure via crafted icns image files

OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing

Kernel: out-of-bounds read vulnerability in smbcalcsize

Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

Gvfs: gvfs-admin socket ownership race permits local root

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

Rsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File Write

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Icu: stack buffer overflow in the srbroot::addtag function

Kernel: use after free bug in btsdio_remove due to race condition