Fedora Project Fedora 36

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

There is an illegal READ memory access at caca/dither.c (function get_rgba_default) in libcaca 0.99.beta19 for 24bpp data.

An attacker who submits a crafted tar file with size in header struct being 0 may be able to trigger an calling of malloc(0) for a variable gnu_longname, causing an out-of-bounds read.

Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page and virtual serial port driver.

In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9

Information Exposure when using Puma with Rails

SQL Injection in ResultSet.refreshRow() with malicious column names in pgjdbc

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the object targeted in CREATE OR REPLACE or CREATE IF NOT EXISTS. Given all three prerequisites, this flaw allows an attacker to run arbitrary code as the victim role, which may be a superuser.

Out-of-bounds Read in vim/vim

Service Hostname Discovery Exploitation in phpCAS

In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.

ClamAV HTML Scanning Memory Leak Vulnerability Affecting Cisco Products: April 2022

Arbitrary configuration injection via `git submodule deinit`

ClamAV TIFF File Parsing Denial of Service Vulnerability Affecting Cisco Products: April 2022

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

global heap buffer overflow in skip_range in vim/vim

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free.

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.

Use after free in append_command in vim/vim

Heap-based Buffer Overflow in function cmdline_erase_chars in vim/vim

Lua scripts can be manipulated to overcome ACL rules in Redis

Buffer Over-read in function grab_file_name in vim/vim

A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. This issue could allow the leakage of both stack and heap addresses, and potentially allow Local Privilege Escalation to the root user via arbitrary code execution.

Buffer Over-read in vim/vim

Heap-based Buffer Overflow in vim/vim

Out-of-bounds Read in vim/vim

Buffer Over-read in vim/vim

Out-of-bounds Read in vim/vim

Heap-based Buffer Overflow in vim/vim

Out-of-bounds Write in vim/vim

Out-of-bounds Read in vim/vim

Stack-based Buffer Overflow in vim/vim

Injection in fish

Use After Free in vim/vim

Liblouis through 3.21.0 has a buffer overflow in compilePassOpcode in compileTranslationTable.c (called, indirectly, by tools/lou_checktable.c).

Heap-based Buffer Overflow in vim/vim

Out-of-bounds Write in vim/vim

Integer Overflow or Wraparound in vim/vim

Out-of-bounds Write in vim/vim