nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,…

There's a flaw in libxml2 in versions before 2.9.11

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are…

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server

sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote…

Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have…

XZ has a heap-use-after-free bug in threaded .xz decoder

netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()

HTTP/2 push headers memory-leak

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation

virtio-net: fix len check in receive_big()

netfilter: conntrack_irc: fix possible out-of-bounds read

isofs: validate Rock Ridge CE continuation extent against volume size

ipv4: icmp: validate reply type before using icmp_pointers

netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

Gnutls: vulnerability in gnutls othername san export

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow

ipv6: use RCU in ip6_xmit()

ndisc: extend RCU protection in ndisc_send_skb()

Openssh: regresshion - race condition in ssh allows rce/dos

nscd: Stack-based buffer overflow in netgroup cache

curl before 7.86.0 has a double free

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used together with `--remove-on-error`

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that…

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography…

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary…

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction…

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0

NFSD: NFSv4 file creation neglects setting ACL

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

ipv4: igmp: remove multicast group from hash table on device destruction

proc: protect ptrace_may_access() with exec_update_lock (FD links)

i2c: core: fix adapter deregistration race

i2c: core: fix adapter registration race

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

quota: Fix race of dquot_scan_active() with quota deactivation

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

io_uring/poll: fix signed comparison in io_poll_get_ownership()

netfilter: nf_queue: hold bridge skb->dev while queued

bpf: Free reuseport cBPF prog after RCU grace period.