Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

Xorg: xwayland: use-after-free in syncinittrigger()

Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

X.org: xwayland: use-after-free of the root cursor

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability

Networkmanager-libreswan: local privilege escalation via leftupdown

Qemu-kvm: 'qemu-img info' leads to host file read/write

Xorg-x11-server: use-after-free in procrenderaddglyphs

Xorg-x11-server: heap buffer overflow in disabledevice

Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function

Xorg-x11-server: selinux context corruption

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

Perl: write past buffer end via illegal user-defined unicode property

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

Insights-client: unsafe handling of temporary files and directories

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Libx11: integer overflow in xcreateimage() leading to a heap overflow

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

Gcc: libstdc++ integer overflow in `new` operator

Kernel: secure boot does not automatically enable kernel lockdown

Glib: integer overflow in in g_escape_uri_string()

Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulation

Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

Tracker-miners: sandbox escape

Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg

Bluez: stack overflow in name2utf8 causes dos and potential code execution

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

Gstreamer1-plugins-good: gstreamer: heap buffer overflow in wavpack decoder via integer overflow

389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow

Grub2: net: out-of-bounds write in grub_net_search_config_file()

Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients