HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

procfs: fix possible double mmput() in do_procmap_query()

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP ANI File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSD File Parsing Integer Overflow Remote Code Execution Vulnerability

OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

GStreamer H.266 Codec Parser Integer Underflow Remote Code Execution Vulnerability

GStreamer RIFF Palette Integer Overflow Remote Code Execution Vulnerability

GStreamer H.266 Codec Parser Out-Of-Bounds Write Remote Code Execution Vulnerability

GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability

GStreamer RealMedia Demuxer Out-Of-Bounds Write Remote Code Execution Vulnerability

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

In OCaml before 4.14.3 and 5.x before 5.4.1, a buffer over-read in Marshal deserialization (runtime/intern.c) enables remote code execution through a multi-phase attack chain

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

Xorg: xwayland: use-after-free in syncinittrigger()

Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

X.org: xwayland: use-after-free of the root cursor

Glib: integer overflow in in g_escape_uri_string()

Spice-server: spice: heap oob read/write via unchecked migration data offsets

Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing