Microsoft Security Response Center

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes

Use-after-free in PQC hybrid key-share handling

Continued acceptance of SHA-1/MD5 digests in certificate processing

Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured

Out-of-bounds heap read in SM2/SM3 certificate Subject Key Identifier computation

Partial-chain verification accepts untrusted intermediate as trust anchor

PKCS7_verify signer confusion allows forged signatures to be accepted

X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert()

TLS 1.3 post-handshake authentication: server accepts Finished without client Certificate/CertificateVerify

AES-GCM streaming APIs do not reject >64 GiB cumulative single messages, enabling counter wrap and keystream reuse

Missing SNI/ALPN binding on stateful (session-ID) TLS session resumption

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

X.509 trust-chain bypass in wolfSSL_X509_verify_cert() via untrusted intermediate anchoring

ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery

OCSP CertID serial-number length-confusion in wolfSSL_OCSP_resp_find_status

HMAC-BLAKE2 final discards message when key length exceeds block size

X25519 x86_64 assembly final reduction leaves non-canonical field element

Wildcard DNS SAN bypasses CA name-constraint checks

Out-of-bounds write in SetSuitesHashSigAlgo on oversized signature algorithms list

Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage

X.509 name constraint bypass via Subject CN treated as a DNS name

ML-KEM ARM64 NEON ciphertext comparison only compares half of the input

HMAC zero-length tag forgery in EVP_DigestVerifyFinal

Heap buffer overread in wc_PKCS7_DecodeEnvelopedData parsing crafted PKCS7 EnvelopedData

Integer underflow in wc_PKCS7_DecryptOri handling crafted Other Recipient Info

wolfSSL_PKCS7_verify() reports success for degenerate (certs-only) PKCS#7 with no signer

PKCS#12 MAC verification uses attacker-controlled comparison length

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA (temporary CA exemption)

Un-negotiated Raw Public Key (RFC 7250) accepted in place of X.509, bypassing chain validation

CRL critical extension bypass in ParseCRL_Extensions

iPAddress name constraints not enforced when WOLFSSL_IP_ALT_NAME is undefined

Bleichenbacher padding oracle in PKCS#7 KTRI RSA PKCS#1 v1.5 decryption

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

Virt-handler-rhel9: kubevirt: kubevirt: disabletls migration setting removes authentication, exposing unauthenticated virtqemud proxy on all interfaces

Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher

Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body

Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

ws: Memory exhaustion DoS from tiny fragments and data chunks

NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module vulnerability

Stack-Based Buffer Overflow in libxml2

Global Buffer Overflow in GNU gzip

agp/amd64: Fix broken error propagation in agp_amd64_probe()

attr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr

Predictable Temporary File in GNU gzip

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

ip6_vti: set netns_immutable on the fallback device.

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

drm/gma500/oaktrail_lvds: fix hang on init failure

mailbox: add sanity check for channel array

WebOb: Location header normalization during redirect leads to open redirect

padata: Put CPU offline callback in ONLINE section to allow failure

f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show()

audit: fix incorrect inheritable capability in CAPSET records

ice: fix NULL pointer dereference in ice_reset_all_vfs()

mailbox: mailbox-test: don't free the reused channel

drm/amdgpu: fix AMDGPU_INFO_READ_MMR_REG

net: mana: Guard mana_remove against double invocation

ALSA: hda/conexant: Fix missing error check for jack detection

tty: hvc_iucv: fix off-by-one in number of supported devices

drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths

scsi: sg: Resolve soft lockup issue when opening /dev/sgX

ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

btrfs: only release the dirty pages io tree after successful writes

net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind

mailbox: mailbox-test: free channels on probe error

nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

Bluetooth: fix memory leak in error path of hci_alloc_dev()

Vim: Out-of-bounds Read in Text Property Count

nvmem: core: fix use-after-free bugs in error paths

ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

sctp: disable BH before calling udp_tunnel_xmit_skb()

IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN

netdevsim: zero initialize struct iphdr in dummy sk_buff

xfrm: espintcp: do not reuse an in-progress partial send

ceph: fix a buffer leak in __ceph_setxattr()

bpf, sockmap: Fix af_unix null-ptr-deref in proto update

crypto: ccp - copy IV using skcipher ivsize

Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`

quota: Fix race of dquot_scan_active() with quota deactivation

libceph: Fix potential out-of-bounds access in osdmap_decode()

net: phy: clean the sfp upstream if phy probing fails

Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes

netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check

net: pull headers in qdisc_pkt_len_segs_init()

powerpc/64s: Fix unmap race with PMD migration entries

net/sched: cls_fw: fix NULL dereference of "old" filters before change()

drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs

Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247

netfilter: nft_ct: fix missing expect put in obj eval

ipc/shm: serialize orphan cleanup with shm_nattch updates

Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception