NVD Listing: CVE-2021-27364

An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-37434 

zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-40674 

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-25236

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-25315 

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2020-29661 

A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allows a use-after-free attack against TIOCSPGRP, aka CID-54ffccbf053b.

NVD Entry: CVE-2021-22543

An issue was discovered in Linux: KVM through Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2018-25032 

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2021-4034 

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

NVD Listing: https://nvd.nist.gov/vuln/detail/CVE-2022-25235 

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.