Local Information Disclosure via Stale Stream Table Access in ARM SMMU v3 on Android

In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream identifiers due to a logic error. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

Android Image Processing Bounds Check Error Enables Physical Privilege Escalation

In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing bounds check. This could lead to physical escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with execution privileges needed. User interaction is for exploitation.

In stpropnci_cb_observe_mode_suspend of stpropnci_prop_android.cc, there is a possible way to trigger an out of bounds write into global state due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Invalid pointer in the DOM: Streams component

Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Incorrect boundary conditions, use-after-free in the Graphics component

Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Privilege escalation in the Nimbus Desktop Client component

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Incorrect boundary conditions in the Graphics: CanvasWebGL component

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the DOM: Editor component

Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the Layout: Positioned component

Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape due to use-after-free in the DOM: Service Workers component

Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Clickjacking issue in the Autofill component in Firefox for Android

Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160.

Uninitialized memory in the Graphics: WebGPU component

Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape in the Graphics: WebGPU component

Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Sandbox escape in the Agent component

Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

Information disclosure in the Layout component

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.