ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file…

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be…

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform

An issue was discovered in libxml2 before 2.10.3

A flaw was found in glibc

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize

There's a flaw in libxml2's xmllint in versions before 2.9.11

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used

In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is…

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11

OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an experimental key type, has a pre-authentication integer overflow if a client or server is configured to use a…

GNU gdb All versions is affected by: Buffer Overflow - Out of bound memory access

A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as…

A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in…

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file

net, bpf: check master for NULL in xdp_master_redirect()

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

flow_dissector: do not dissect PPPoE PFC frames

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input

net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in…

net: macb: Use dev_consume_skb_any() to free TX SKBs

Potential buffer under-read in ungetwc

net/x25: Fix overflow when accumulating packets

iconv crash due to assertion failure with untrusted input

gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

nghttp2 Denial of service: Assertion failure due to the missing state validation

RDMA/siw: Fix potential NULL pointer dereference in header processing

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions

scsi: target: Reset t_task_cdb pointer in error case

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted

ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock()

netfilter: nft_ct: add seqadj extension for natted connections

Out-of-bounds read & write in RFC 3211 KEK Unwrap

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

net: ethernet: lantiq_etop: fix memory disclosure

Possible denial of service in X.509 name checks

An issue was discovered in libexpat before 2.6.3

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear…

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)