In BitmapImageBuffer of bitmap_image_buffer.h, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

In aoc_unlocked_ioctl_handle_ion_fd of aoc.c, there is a possible type confusion due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of rmmi_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

In IMG_vkCreateImageView of image_view.c, there is a possible way to trigger a use after free due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Local Information Disclosure via Stale Stream Table Access in ARM SMMU v3 on Android

In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Android Image Processing Bounds Check Error Enables Physical Privilege Escalation

In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.

In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Invalid pointer in the DOM: Streams component

Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Incorrect boundary conditions, use-after-free in the Graphics component

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Privilege escalation in the Nimbus Desktop Client component

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Incorrect boundary conditions in the Graphics: CanvasWebGL component

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the Layout: Positioned component

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape due to use-after-free in the DOM: Service Workers component

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.