A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling

A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use

A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error

A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory

The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege…

A potential use-after-free found through fuzzing during DOM manipulation of SVG content

Use-after-free while manipulating XSL in XSLT documents

Use-after-free while manipulating DOM events and removing audio elements due to errors in the handling of node adoption

Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor

Memory safety bugs were reported in Thunderbird 45.5

procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary…

Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before…

The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to…

The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary…

The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial…

Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors…

Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and…

Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbitrary code or cause…

Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors

ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of…

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

MariaDB: mysql_real_escape_string() incorrectly handled big5

Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling

Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing.

Gnutls: gnutls: denial of service via dtls zero-length fragment

Undertow: undertow: request smuggling via malformed http request headers

Undertow: undertow: request smuggling via inconsistent header parsing

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file

An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of the pcre2_jit_compile.c file

An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS before version 0.3.18

A flaw was found in libwebp in versions before 1.0.1

A flaw was found in libwebp in versions before 1.0.1

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ShiftBytes()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE24()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in ApplyFilter()

A heap-based buffer overflow was found in libwebp in versions before 1.0.1 in GetLE16()

From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data

An out-of-bounds read while processing SVG content in "ConvolvePixel"

An out-of-bounds read during the processing of glyph widths during text layout

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes…