expat: integer overflow in the doProlog function

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

expat: Integer overflow in function XML_GetBuffer

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.

libxml2: Use-after-free of ID and IDREF attributes

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

glibc: Stack-based buffer overflow in sunrpc clnt_create via a long pathname

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

glibc: Stack-based buffer overflow in svcunix_create via long pathnames

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

expat: Integer overflow in storeAtts in xmlparse.c

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in nextScaffoldPart in xmlparse.c

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in lookup in xmlparse.c

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in defineAttribute in xmlparse.c

defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in build_model in xmlparse.c

build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

expat: Integer overflow in addBinding in xmlparse.c

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

curl: OAUTH2 bearer bypass in connection re-use

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

kernel: lockdown bypass using IMA

In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents setting "ima_appraise=log" from the boot param when Secure Boot is enabled, but this does not cover cases where lockdown is used without Secure Boot. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity, Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

hw: cpu: incomplete clean-up in specific special register write operations (aka DRPW)

Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

hw: cpu: incomplete clean-up of microarchitectural fill buffers (aka SBDS)

Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

hw: cpu: incomplete clean-up of multi-core shared buffers (aka SBDR)

Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.

kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c

In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel

kernel: possible use after free due to improper locking in l2cap_chan_put of l2cap_core

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel

In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel

Microsoft Office SharePoint Information Disclosure Vulnerability

Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.