Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.

Integer overflow in the vcresize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow.

Integer overflow in the ipoptionsget function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (kernel crash) via a cmsglen that contains a -1, which leads to a buffer overflow.

Memory leak in the ipoptionsget function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by repeatedly calling the ipcmsgsend function.

/proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially sensitive information such as the length of passwords.