scanf %mc off-by-one heap buffer overflow

Integer overflow in memalign leads to heap corruption

nscd: Stack-based buffer overflow in netgroup cache

Buffer overflow in strfmon and strfmon_l right-justification padding

Potential buffer under-read in ungetwc

iconv crash due to assertion failure with untrusted input

gethostbyaddr and gethostbyaddr_r may incorrectly handle DNS response

wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory

getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler

nscd: netgroup cache assumes NSS callback uses in-buffer strings

Potential buffer overflow in ns_sprintrrf TSIG handling path

nscd: netgroup cache may terminate daemon on memory allocation failure

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT…

Potential stack-based buffer clash during tilde expansion in wordexp

Buffer overread in ns_printrrf with corrupted RDATA field

AT_SECURE programs may load attacker-controlled code via $ORIGIN

Calling NSS-backed functions that support caching via nscd may call the nscd client side code and in the GNU C Library version 2.36 under high load on x86_64 systems, the client…

When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which…

EUC_JISX0213 decoding may hang on crafted input

SHIFT_JISX0213 decoding may hang on crafted input

nscd: Null pointer crashes after notfound response

Stack-based out-of-bounds write in tdelete during tree rebalancing

gethostbyaddr and gethostbyaddr_r return invalid DNS hostnames

Assertion failure in the DNS stub resolver with a long search domain

Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap…

Stack overflow in nscd due to unbounded alloca use

One-byte overread in strncasecmp on Power8

AT_SECURE program buffer overflow via $ORIGIN processing