Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

Microsoft Office Information Disclosure Vulnerability

kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types.

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length which may result in a buffer overflow potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length which may result in a buffer overflow potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

NULL Pointer Dereference in lxml/lxml

Stack-based Buffer Overflow in vim/vim

Chromium: CVE-2022-2295 Type Confusion in V8

Chromium: CVE-2022-2294 Heap buffer overflow in WebRTC

Use After Free in vim/vim

Out-of-bounds Write in vim/vim

Out-of-bounds Read in vim/vim

Out-of-bounds Read in vim/vim

Integer Overflow or Wraparound in vim/vim

Heap-based Buffer Overflow in vim/vim

LibTIFF 4.3.0 has an out-of-bounds read in _TIFFmemcpy in tif_unix.c in certain situations involving a custom tag and 0x0200 as the second word of the DE field.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.