Use After Free in vim/vim

Heap-based Buffer Overflow in vim/vim

Untrusted Search Path in vim/vim

Out-of-bounds Write in vim/vim

Integer Overflow or Wraparound in vim/vim

Use After Free in vim/vim

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed because the presence of EOR does not lead to a treat-as-withdraw outcome.

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and additional NLRI data (that lacks mandatory path attributes).

The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug) code. For physically proximate attackers with local access this "could be exploited in a real world scenario." This is related to brcmf_cfg80211_escan_timeout_worker in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c.

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass. An implicit $G user in an authorization block can sometimes be used for unauthenticated access even when the intention of the configuration was for each user to have an account. The earliest affected version is 2.2.0.

Perl: perl for windows binary hijacking vulnerability

Perl: write past buffer end via illegal user-defined unicode property

Grub2: out-of-bounds read at fs/ntfs.c

Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit an io_uring/fdinfo.c io_uring_show_fdinfo NULL pointer dereference can occur.

In Memcached before 1.6.22 an off-by-one error exists when processing proxy requests in proxy mode if \n is used instead of \r\n.

In Memcached before 1.6.22 a buffer overflow exists when processing multiget requests in proxy mode if there are many spaces after the "get" substring.

Squid: denial of service in http digest authentication