Sandbox escape in the Responsive Design Mode component

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to use-after-free in the Disability Access APIs component

Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software

Sandbox escape in the Storage: IndexedDB component

Sandbox escape in the Graphics: WebRender component

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component

Uninitialized memory in the Audio/Video: Web Codecs component

A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545 and Commit d20315b

A heap-based buffer overflow vulnerability exists in the x3f_thumb_loader functionality of LibRaw Commit d20315b

Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2

nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

lodash vulnerable to Code Injection via `_.template` imports key names

Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149

Mitigation bypass in the Networking: HTTP component

JIT miscompilation in the JavaScript Engine: JIT component

Use-after-free in the Layout: Text and Fonts component

Use-after-free in the CSS Parsing and Computation component

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack

FreeRDP has a Heap Buffer Overflow in nsc_process_message() via Unchecked SURFACE_BITS_COMMAND Bitmap Dimensions

Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

Privilege escalation in the Messaging System component

Mitigation bypass in the DOM: HTML Parser component

Integer overflow in the Audio/Video component

Incorrect boundary conditions in the Web Audio component

Use-after-free in the Audio/Video: Playback component

Undefined behavior in the DOM: Core & HTML component

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine component

Integer overflow in the JavaScript: Standard Library component

Incorrect boundary conditions in the Graphics: ImageLib component

Use-after-free in the JavaScript: GC component

Incorrect boundary conditions in the WebRTC: Audio/Video component

Heap-use-after-free in gdi_set_bounds

FreeRDP has heap-buffer-overflow in clear_decompress_residual_data

FreeRDP has heap-buffer-overflow in gdi_SurfaceToSurface

FreeRDP has heap-buffer-overflow in clear_decompress

FreeRDP has heap-buffer-overflow in planar_decompress_plane_rle

Sandbox escape due to incorrect boundary conditions in the Graphics component

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.