CVE Vulnerability Catalog

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

JIT miscompilation in the JavaScript: WebAssembly component. Fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Memory safety bugs in Thunderbird ESR 140.12 that could allow arbitrary code execution. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

Memory safety bugs in Firefox ESR 115.37, Firefox ESR 140.12, and Firefox 152 may lead to memory corruption and potentially arbitrary code execution. Fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Vulnerability in the Audio/Video: GMP component in Firefox and Thunderbird. Incorrect boundary conditions. Fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

A vulnerability in the Graphics component in Firefox and Thunderbird is due to incorrect boundary conditions. This was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

JIT miscompilation in the JavaScript Engine leads to incorrect code execution. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Invalid pointer in the DOM: Bindings (WebIDL) component may cause unexpected behavior. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

A use-after-free vulnerability in the DOM: Navigation component allows sandbox escape. The flaw was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Incorrect boundary conditions in the Audio/Video: cubeb component may lead to memory errors. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::dynamicData(). The function passes a Class::method callable string and its arguments directly to call_user_func_array() without any allowlist. Because the form plugin routes page frontmatter through this path, an authenticated account with admin.pages (or api.pages.write) permission can plant a malicious callable directive in a page. The command executes as the web-server user whenever anyone – including an unauthenticated visitor – accesses the page.

The Grav api plugin (grav-plugin-api) before version 1.0.8 fails to properly authorize API key generation and revocation. It intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.

An SQL injection vulnerability has been discovered in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama due to improper neutralization of special elements in SQL commands. The issue affects versions from 5.1.2 before 5.1.3.

A deserialization of untrusted data vulnerability in Apache Fory allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected.

An out-of-bounds read vulnerability was found in Apache Fory (formerly Apache Fury) via sun.misc.Unsafe. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. This feature is opt-in, so applications not using it are unaffected.

A heap type confusion and out-of-bounds read/write vulnerability has been discovered in the C++ implementation of Apache Fory. During deserialization in compatible mode, field-skip paths fail to properly validate declared field types against actual data, allowing inconsistent schema input to cause type confusion and out-of-bounds memory access.