Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

net: ethernet: lantiq_etop: fix memory disclosure

Possible denial of service in X.509 name checks

An issue was discovered in libexpat before 2.6.3

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear…

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate)

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are…

Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

Incorrect cipher key & IV length processing

An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3

Glibc: dos due to memory leak in getaddrinfo.c

A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499

Gvariant offset table entry size is not checked in is_normal()

A use-after-free exists in Python through 3.9 via heappushpop in heapq

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory

Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec

A vulnerability was found in openldap

An issue found in SQLite SQLite3 v.3.35.4 that allows a remote attacker to cause a denial of service via the appendvfs.c function

Excessive Resource Usage Verifying X.509 Policy Constraints

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters

Double free after calling PEM_read_bio_ex

Use-after-free following BIO_new_NDEF

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP

An issue was discovered in libxml2 before 2.10.3

An issue was discovered in Python before 3.11.1

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations

A flaw was found in python

In SQlite 3.31.1, a potential null pointer derreference was found in the INTERSEC query processing

A flaw was found in glibc

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API

A vulnerability found in gnutls

In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled

libcurl provides the `CURLOPT_CERTINFO` option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious…

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used…

The curl URL parser wrongly accepts percent-encoded URL separators like '/'when decoding the host name part of a URL, making it a *different* URL usingthe wrong host name when it…

An information disclosure vulnerability exists in curl 7.65.0 to 7.82.0 are vulnerable that by using an IPv6 address that was in the connection pool but with a different zone id…

Resource leakage when decoding certificates and keys

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches

A flaw was found in python

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString

A flaw was found in Python, specifically within the urllib.parse module

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation…

In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is…

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line…

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query

In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference