Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Tar: tar: hidden file injection via crafted archives

Libinput: libinput: information disclosure via dangling pointer in lua plugin handling

Firewalld: firewalld: local unprivileged user can modify firewall state due to d-bus setter mis-authorization

Gimp: gimp: denial of service via crafted psp image file

Polkit: polkit: denial of service via unbounded input processing through standard input

Libsoup: libsoup: http smuggling and server-side request forgery via malformed hostnames

Libvirt: information disclosure via world-readable vm snapshots

Libvirt: denial of service in xml parsing

Libxslt: use-after-free with key data stored cross-rvt

Libgepub: integer overflow in libgepub's epub archive handling

Gnuplot: gnuplot heap-buffer overflow on utf8_copy_one

Xfig: fig2dev segmentation fault in read_arcobject

Xfig: transfig: fig2dev segmentation fault vulnerability

Xfig: fig2dev stack-overflow via read_objects

Sqlite: use-after-free bug in jsonparseaddnodearray

Reachable assertion in avahi_alternative_host_name

Reachable assertion in avahi_rdata_parse

Reachable assertion in dbus_set_host_name

Reachable assertion in avahi_escape_label

Reachable assertion in avahi_dns_packet_append_record

Kernel: rsvp: out-of-bounds read in rsvp_classify()

G_variant_byteswap() can take a long time with some non-normal inputs

Gvariant deserialisation does not match spec for non-normal data

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership

Sssd: sssd: access control bypass via improper ldap shadow expiration check

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt()

JIT miscompilation in the DOM: Core & HTML component

Memory safety bug fixed in Thunderbird 152

Glib: glib: memory corruption via integer overflow in unicode case conversion

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

Sssd: sssd: information disclosure via query injection in entra id lookups

Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body