Internally found bugs fixed in Firefox 154

Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154

Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.

Windows SmartScreen Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in Windows SmartScreen allows an authorized attacker to elevate privileges locally.

Microsoft PowerShell Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.

Windows NetBIOS Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to elevate privileges locally.

Windows Cryptographic Services Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

Windows Update Service Elevation of Privilege Vulnerability

Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.

Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability

Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.

Windows DHCP Server Remote Code Execution Vulnerability

Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

Windows OLE Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows OLE allows an authorized attacker to elevate privileges locally.

Windows Win32k Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.

Windows libarchive Remote Code Execution Vulnerability

Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network.

Windows Kernel Information Disclosure Vulnerability

Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally.

Windows Kerberos Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally.

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).