A NULL pointer dereference vulnerability was found in graphviz in the rebuildvlists function. A maliciously crafted file could cause the application to crash.

References:

https://issuetracker.google.com/issues/77810342

Upstream issue:

https://gitlab.com/graphviz/graphviz/issues/1367

A flaw was found in http-proxy-agent versions before 2.1.0. The http-proxy-agent passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).

References: https://hackerone.com/reports/321631

Patch: https://github.com/TooTallNate/node-http-proxy-agent/commit/b7b7cc793c3226aa83f820ce5c277e81862d32eb

End of life: 11/30/2018, Latest version: 27

In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. As it is an unsigned value, memset ends up writing up to 0xffffffff zero's (0xffffffffffffffff in 64 bit platforms), making dnsmasq crash.