Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

Librsvg: use-after-free when xml includes have duplicated entities

Emacs: emacs: arbitrary code execution in flymake mode

Gimp: integer overflow when generating a thumbnail preview for a psd file

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Emacs: emacs: command injection via crafted filenames in tramp

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file

Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

drm/gem: Try to fix change_handle ioctl, attempt 4

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

dm log: fix out-of-bounds write due to region_count overflow

drm/amdgpu: avoid double drm_exec_fini() in userq validate

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

Heap buffer overflow in Calc formula compilation

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

Vim: Arbitrary Code Execution via Python Omni-Completion

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path