heap buffer overflow in libaom

Chromium: CVE-2024-5160 Heap buffer overflow in Dawn

Chromium: CVE-2024-5159 Heap buffer overflow in ANGLE

Chromium: CVE-2024-5158 Type Confusion in V8

Chromium: CVE-2024-5157 Use after free in Scheduling

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, that may lead to application exit, in tinyxml2.cpp XMLUtil::GetCharacterRef.

libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpeg_l3_encode.c mpeg_l3_encoder_close.

libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out-of-bounds read.

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_traces_proto_ng() at opentelemetry_prot.c.

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

Git does not sanitize URLs when asking for credentials interactively

GitHub: CVE-2024-50338 Malformed URL allows information disclosure through git-credential-manager

ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

HID: core: zero-initialize the report buffer

security/keys: fix slab-out-of-bounds in key_task_permission

regulator: rtq2208: Fix uninitialized use of regulator_config

sctp: properly validate chunk size in sctp_sf_ootb()

net: enetc: allocate vf_state during PF probes