expat: Integer overflow in storeRawNames()

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

expat: Integer overflow in copyString()

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

expat: Stack exhaustion in doctype parsing

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before 2.5.3 SU1 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and crash) via an op_response action with a non-empty status.

Tomcat/JbossWeb: security manager bypass via EL expressions

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.

lcms: insufficient ICC profile version validation (OpenJDK 2D, 8031335)

Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.

expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.

cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

expat: integer overflow in the doProlog function

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

expat: Integer overflow in function XML_GetBuffer

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

libxml2: Use-after-free of ID and IDREF attributes

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

glibc: Stack-based buffer overflow in svcunix_create via long pathnames

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

expat: Integer overflow in storeAtts in xmlparse.c

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in nextScaffoldPart in xmlparse.c

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in lookup in xmlparse.c

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in defineAttribute in xmlparse.c

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in build_model in xmlparse.c

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in addBinding in xmlparse.c

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.