Gnutls: gnutls: information disclosure via heap overread in rsa key exchange

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Vim modeline bypass via various options affects Vim < 9.2.0276

Corosync: corosync: denial of service and information disclosure via crafted udp packet

Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment

Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension…

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152

Incorrect boundary conditions in the Web Audio component

Memory safety bug fixed in Thunderbird 152

Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

A heap-based buffer overflow vulnerability exists in the x3f_load_huffman functionality of LibRaw Commit d20315b

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O…

LIBPNG has a heap buffer overflow in png_set_quantize

Podman: podman kube play command may overwrite host files

Sssd: sssd: gpo cache path traversal via unsanitized gpcfilesyspath allows kerberos authentication bypass

Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

Libvirt: swtpm privilege escalation via symlink following

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

dm log: fix out-of-bounds write due to region_count overflow

ipc: limit next_id allocation to the valid ID range

net/sched: fix pedit partial COW leading to page cache corruption

Heap buffer overflow in Calc formula compilation

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data