It was reported [1] that the Linux kernel suffered from a flaw when doing key garbage collection. The patch [1] describes the issue as:

""" When a key is being garbage collected, it's key->user would get put before the ->destroy() callback is called, where the key is removed from it's respective tracking structures.

This leaves a key hanging in a semi-invalid state which leaves a window open for a different task to try an access key->user. An example is findkeyringbyname() which would dereference key->user for a key that is in the process of being garbage collected (where key->user was freed but ->destroy() wasn't called yet - so it's still present in the linked list).

"""

An unprivileged local user could use this flaw to crash the system.

[1] http://marc.info/?l=linux-kernel&m=141986398232547&w=2

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

The following flaw was found in ntpd:

Using a crafted packet to create a peer association with hmode > 7 causes the MATCHASSOC() lookup to make an out-of-bounds reference.

Upstream bugs:

http://support.ntp.org/bin/view/Main/NtpBug3009

External References:

http://support.ntp.org/bin/view/Main/SecurityNotice#April2016NTP428p7Security