Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

netfilter: flowtable: strictly check for maximum number of actions

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

Pcp: pcp: denial of service due to signed integer overflow

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

Gstreamer1-plugins-bad-free: gstreamer: dtls certificate subject dn stack buffer overflow in openssl_verify_callback

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Dracut: dracut: root code execution via dhcp options command injection

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

Apache HTTP Server: mod_http2 denial of service

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Incorrect boundary conditions in the Audio/Video: Web Codecs component

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability