| 1426988
|
|
UAF crash in libvpx 1.6.1
|
Core
|
WebRTC: Audio/Video
|
drno
|
RESO
|
FIXE
|
2018-08-28
|
| 1425520
|
|
Crash in nsPlainTextSerializer::ForgetElementForPreformat
|
Core
|
DOM: Serializers
|
hsivonen
|
RESO
|
FIXE
|
2019-08-17
|
| 1437087
|
|
heap-use-after-free in [@ mozilla::EditorEventListener::UninstallFromEditor]
|
Core
|
DOM: Editor
|
m_kato
|
RESO
|
FIXE
|
2019-05-24
|
| 1434384
|
|
AddressSanitizer: BUS on unknown address 0x000000000000 [@ __asan::asan_free] with clobbered bp involving StructuredClone
|
Core
|
JavaScript Engine
|
sphink
|
RESO
|
FIXE
|
2021-10-06
|
| 1416529
|
|
AddressSanitizer: heap-use-after-free @ mozilla::net::Http2Session::ProcessConnectedPush()
|
Core
|
Networking: HTTP
|
u408661
|
RESO
|
FIXE
|
2020-02-28
|
| 1324042
|
|
Heap buffer over read [@nsTextFrame::GetRenderedText]
|
Core
|
Layout: Text and Fon
|
dholbert
|
RESO
|
FIXE
|
2018-08-28
|
| 1438425
|
|
PDocumentRenderer __delete__() passes a size and a buffer, without length checks
|
Core
|
Graphics
|
jmuizelaar
|
RESO
|
FIXE
|
2019-05-24
|
| 1443865
|
|
OOB write in libvpx 1.6.1
|
Core
|
WebRTC: Audio/Video
|
giles
|
RESO
|
FIXE
|
2019-05-24
|
| 1434580
|
|
Testcase for bug 1423159 fails in different place on esr52
|
Core
|
DOM: Events
|
smaug
|
RESO
|
FIXE
|
2019-05-24
|
| 1437450
|
|
Assertion failure: startOfUninitialized <= nfixed, at js/src/jit/MacroAssembler.cpp:1163
|
Core
|
JavaScript Engine: J
|
nobody
|
VERI
|
FIXE
|
2023-12-06
|
| 1437507
|
|
Assertion failure: !shape->inDictionary(), at js/src/vm/Shape.cpp:271
|
Core
|
JavaScript Engine
|
bhackett1024
|
VERI
|
FIXE
|
2023-12-06
|