FreeRDP has Out-of-bounds Write

FreeRDP has Out-of-bounds Write

Use-after-free in the Storage: IndexedDB component

Heap buffer overflow in libvpx

Use-after-free in the IPC component

Sandbox escape due to integer overflow in the Graphics component

Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash

Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems

Libtiff: libtiff write-what-where

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression

Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component

Sandbox escape due to incorrect boundary conditions in the Telemetry component

Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response

Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication

Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

Udisks: out-of-bounds read in udisks daemon

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

Gnutls: gnutls: certificate validation bypass due to oversized subject alternative name

Vim modeline bypass via various options affects Vim < 9.2.0276

Corosync: corosync: denial of service and information disclosure via crafted udp packet

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)

ImageMagick - Command Injection via SVG Decoder

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Incorrect boundary conditions in the Web Audio component

Memory safety bug fixed in Thunderbird 152

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write

LIBPNG has a heap buffer overflow in png_set_quantize

Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

Mitigation bypass in the DOM: Security component

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

The issue was addressed with improved checks

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

Libvirt: swtpm privilege escalation via symlink following

dm log: fix out-of-bounds write due to region_count overflow

ipc: limit next_id allocation to the valid ID range

Heap buffer overflow in Calc formula compilation

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels