patch: Out-of-bounds access in pch_write_line function in pch.c

An issue was discovered in GNU patch before 2.7.6. Out-of-bounds access within pch_write_line() in pch.c can possibly lead to DoS via a crafted input file.

gnutls: First byte of the padding in CBC mode is not checked

GnuTLS incorrectly validates the first byte of padding in CBC modes

coreutils: possible buffer overflow in keycompare_mb()

Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

coreutils: heap buffer overflow in sort(1) keycompare_mb()

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.

patch: directory traversal via symlinks (incomplete fix for CVE-2015-1196)

A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.

gnutls: certificate algorithm consistency checking issue

GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.

gcc: integer overflow flaws in libgfortran

Multiple integer overflows in libgfortran might allow remote attackers to execute arbitrary code or cause a denial of service (Fortran application crash) via vectors related to array allocation.

handle_messages in eXtl_tls.c in eXosip before 5.0.0 mishandles a negative value in a content-length header.

slim has NULL pointer dereference when using crypt() method from glibc 2.17

bash: heap-based buffer overflow during echo of unsupported characters

A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().

gnusound 0.7.5 has format string issue

glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

glibc: Not closing unhadleable client sockets due to nscd daemon leads to DoS.

The nscd daemon in the GNU C Library (glibc) before version 2.5 does not close incoming client sockets if they cannot be handled by the daemon, allowing local users to carry out a denial of service attack on the daemon.

glibc: buffer overflow in getgrouplist function leading to corrupted memory

The getgrouplist function in the GNU C library (glibc) before version 2.3.5, when invoked with a zero argument, writes to the passed pointer even if the specified array size is zero, leading to a buffer overflow and potentially allowing attackers to corrupt memory.

gcc: Integer overflow can occur during the computation of the memory region size for new[] operator

Integer overflow in the new[] operator in gcc before 4.8.0 allows attackers to have unspecified impacts.

glibc: manual/search.texi lacks a statement about the unspecified tdelete return value upon deletion of a tree's root

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.