SQLite integer overflow in key info allocation may lead to information disclosure.

Libxslt: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Domain Name Validation Bypass with Apple Native Certificate Validation

In the OpenSSL compatibility layer implementation, the function RAND_poll() was not behaving as expected and leading to the potential for predictable values returned from RAND_bytes() after fork() is called. This can lead to weak or predictable random numbers generated in applications that are both using RAND_bytes() and doing fork() operations. This only affects applications explicitly calling RAND_bytes() after fork() and does not affect any internal TLS operations. Although RAND_bytes() documentation in OpenSSL calls out not being safe for use with fork() without first calling RAND_poll(), an additional code change was also made in wolfSSL to make RAND_bytes() behave similar to OpenSSL after a fork() call without calling RAND_poll(). Now the Hash-DRBG used gets reseeded after detecting running in a new process. If making use of RAND_bytes() and calling fork() we recommend updating to the latest version of wolfSSL. Thanks to Per Allansson from Appgate for the report.

Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf

on-headers vulnerable to http response header manipulation

mruby nregs codegen.c scope_new heap-based overflow

btrfs: do not free data reservation in fallback from inline due to -ENOSPC

fs: ntfs3: fix infinite loop triggered by zero-sized ATTR_LIST

fs: ntfs3: check return value of indx_find to avoid infinite loop

fs: ntfs3: fix infinite loop in attr_load_runs_range on inconsistent metadata

audit: add fchmodat2() to change attributes class

scsi: qla2xxx: Fix bsg_done() causing double free

nilfs2: Fix potential block overflow that cause system hang

scsi: qla2xxx: Validate sp before freeing associated memory

scsi: qla2xxx: Delay module unload while fabric scan in progress

wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add

PCI: endpoint: Avoid creating sub-groups asynchronously

scsi: qla2xxx: Free sp in error path to fix system crash