Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write

SQLite integer overflow in key info allocation may lead to information disclosure.

Libxslt: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Domain Name Validation Bypass with Apple Native Certificate Validation

In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers generated in applications that are both using RAND_bytes() and doing fork() operations. This only affects applications explicitly calling RAND_bytes() after fork() and does not affect any internal TLS operations. Although RAND_bytes() documentation in OpenSSL calls out not being safe for use with fork() without first calling RAND_poll(), an additional code change was also made in wolfSSL to make RAND_bytes() behave similar to OpenSSL after a fork() call without calling RAND_poll(). Now the Hash-DRBG used gets reseeded after detecting running in a new process. If making use of RAND_bytes() and calling fork() we recommend updating to the latest version of wolfSSL. Thanks to Per Allansson from Appgate for the report.

Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

on-headers vulnerable to http response header manipulation

mruby nregs codegen.c scope_new heap-based overflow

drm/vkms: Convert to DRM's vblank timer

PCI: endpoint: Add missing NULL check for alloc_workqueue()

drm/display/dp_mst: Add protection against 0 vcpi

drm/panthor: fix for dma-fence safe access rules

spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing

drm/amdgpu: fix NULL pointer issue buffer funcs

drm/amdgpu/ras: Move ras data alloc before bad page check

misc: ti_fpc202: fix a potential memory leak in probe function

fs/ntfs3: handle attr_set_size() errors when truncating files

net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels

wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()