libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a stack-based buffer overflow

A buffer overflow was discovered in libxml2 20904-GITv2.9.4-16-g0741801

nscd: netgroup cache assumes NSS callback uses in-buffer strings

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS

X.400 address type confusion in X.509 GeneralName

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to…

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument

GnuTLS 3.6.x before 3.6.14 uses incorrect cryptography for encrypting a session ticket (a loss of confidentiality in TLS 1.2, and an authentication bypass in TLS 1.3)

GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS

netfilter: ctnetlink: ignore explicit helper on new expectations

Potential buffer overflow in ns_sprintrrf TSIG handling path

gzip integer overflow

erspan: make sure erspan_base_hdr is present in skb->head

nscd: netgroup cache may terminate daemon on memory allocation failure

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT…

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead…

The c_rehash script allows command injection

The c_rehash script allows command injection

http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as…

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

netfilter: ebtables: module names must be null-terminated

netfilter: ebtables: terminate table name before find_table_lock()

isofs: bound Rock Ridge symlink components to the SL record

net: guard timestamp cmsgs to real error queue skbs

netfilter: nf_log: validate MAC header was set before dumping it

crypto: authencesn - reject short ahash digests during instance creation

ptrace: slightly saner 'get_dumpable()' logic

net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak

netfilter: x_tables: ensure names are nul-terminated

netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()

nfnetlink_osf: validate individual option lengths in fingerprints

net/sched: cls_u32: use skb_header_pointer_careful()

net: hns3: add VLAN id validation before using

tracing: Limit access to parser->buffer when trace_get_user failed

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

software node: Correct a OOB check in software_node_get_reference_args()

net/mdiobus: Fix potential out-of-bounds read/write access

ext4: fix OOB read when checking dotdot dir

ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()

net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()

igb: Fix potential invalid memory access in igb_init_module()

netfilter: x_tables: fix LED ID check in led_tg_check()

security/keys: fix slab-out-of-bounds in key_task_permission

bpf: Fix overloading of MEM_UNINIT's meaning

of/irq: Prevent device address out-of-bounds read in interrupt map walk

bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()

nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

media: stk1160: fix bounds checking in stk1160_copy_video()

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or…

netfilter: ebtables: zero chainstack array