archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.

coreutils: tty hijacking possible in "su" via TIOCSTI ioctl

There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process.

I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.

Zoo 2.10 has Directory traversal

gcc: Integer overflow can occur during the computation of the memory region size for new[] operator

Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.

TCP firewalls could be circumvented by sending a SYN Packets with other flags (like e.g. RST flag) set, which was not correctly discarded by the Linux TCP stack after firewalling.

Buffer Over-read in WLAN Host

Transient DOS while parsing ESP IE from beacon/probe response frame.

Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.

Buffer Over-read in WLAN Host

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.

Buffer Over-read in WLAN Host

Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Integer Overflow or Wraparound in WLAN Host

Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

Buffer Over-read in WLAN Host

Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.

Use After Free in Graphics Linux

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.

Integer Overflow or Wraparound in Automotive GPU

Memory corruption while allocating memory in HGSL driver.

Use of Uninitialized Variable in Automotive GPU

Memory corruption while processing IOCTL call to set metainfo.

Buffer Over-read in WLAN HOST

Transient DOS while processing TID-to-link mapping IE elements.

Buffer Over-read in WLAN Host

Transient DOS while parsing the received TID-to-link mapping action frame.

A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout.

In PMRWritePMPageList of pmr.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.