NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2023-26604 

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2023-5156 

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2021-37322 

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2020-8037 

The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2021-45078 

stab_xcoff_builtin_type in stabs.c in GNU Binutils through 2.37 allows attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact, as demonstrated by an out-of-bounds write. NOTE: this issue exists because of an incorrect fix for CVE-2018-12699.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-29404 

In Apache HTTP Server 2.4.53 and earlier, a malicious request to a lua script that calls r:parsebody(0) may cause a denial of service due to no default limit on possible input size.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2023-4806 

A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2017-8804 

The xdr_bytes and xdr_string functions in the GNU C Library (aka glibc or libc6) 2.25 mishandle failures of buffer deserialization, which allows remote attackers to cause a denial of service (virtual memory allocation, or memory consumption if an overcommit setting is not used) via a crafted UDP packet to port 111, a related issue to CVE-2017-8779. NOTE: [Information provided from upstream and references

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2024-24795 

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.