In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted tiff image file, related to transposing width and height values.

The jpcdecprocesssiz function in libjasper/jpc/jpcdec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.

The gitoidnfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file.

Divide by zero vulnerability was found in jpcdecprocesssiz triggered by invoking imginfo command on specially crafted file.

Upstream patch:

https://github.com/mdadams/jasper/commit/d8c2604cd438c41ec72aff52c16ebd8183068020

CVE assignment:

http://www.openwall.com/lists/oss-security/2016/10/16/14

CVE-2016-8568

Read out-of-bounds in gitoidnfmt: https://github.com/libgit2/libgit2/issues/3936

CVE-2016-8569

DoS using a null pointer dereference in gitcommitmessage: https://github.com/libgit2/libgit2/issues/3937

Proposed patch:

https://github.com/libgit2/libgit2/pull/3956