Linux: netback processing of zero-length transmit fragment

An issue was discovered in the Linux kernel before 6.5.9 exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.

An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes e.g. one with only an unknown transit attribute.

An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data leading to a crash.

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Shadow-utils: possible password leak during passwd(1) change

In the Linux kernel before 6.5.9 there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.

In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3 the wrapper scripts do not properly parse command lines.

Integer Overflow in :history command in Vim

Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack

Use-after-free in Linux kernel's af_unix component

zchunk before 1.3.2 has multiple integer overflows via malformed zchunk files to lib/comp/comp.c lib/comp/zstd/zstd.c lib/dl/multipart.c or lib/header.c.

twisted.web has disordered HTTP pipeline response

Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

xkeys Seal encryption used fixed key for all encryption

Use after free race between mbind() and vma-locked page fault