Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Gstreamer1-plugins-bad-free: gstreamer: stack buffer overflow in h.265 buffering period sei parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds write in h.266/vvc pps picture partition parser

389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditions

Samba: missing access check on reparse point operations

Samba: vfs_worm does not block directory modification

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Incorrect boundary conditions in the JavaScript Engine: JIT component

FreeRDP: Progressive Codec Quant BYTE Underflow - UB + CPU DoS

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Gimp: gimp: memory corruption due to integer overflow in ico file handling

Libarchive: libarchive: denial of service via malformed iso file processing

Libsoup: libsoup: header and http request injection via crlf injection

Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Libsoup: libsoup: http request smuggling via malformed chunk headers

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Gnutls: null pointer dereference in _gnutls_figure_common_ciphersuite()

Libssh: double free vulnerability in libssh key export functions

Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c

Crossbeam-channel: crossbeam-channel vulnerable to double free on drop

Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c

Libsoup: null pointer dereference in client when server omits the "nonce" parameter in an unauthorized response with digest authentication

Libsoup: null pointer deference on libsoup via /auth/soup-auth-digest.c through "soup_auth_digest_authenticate" on client when server omits the "realm" parameter in an unauthorized response with digest authentication

Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space()

Libsoup: heap buffer overflow in sniff_unknown()

Golang-fips: golang fips zeroed buffer

Sssd: use-after-free crash in sssd' 'sssd_pam' process

Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks

Grub2: command/gpg: use-after-free due to hooks not being removed on module unload

Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio

Gimp: gimp: heap buffer overflow in hot color filter on oversized image

Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions

Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

Evolution: evolution: javascript execution via spoofed vcard control bypasses mail script-markup restriction

Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing

M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8