Integer overflow in the btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFSIOCCLONERANGE ioctl call.

Description of problem: If the donor file is an append-only file, we should not allow the operation to proceed, lest we end up overwriting the contents of an append-only file.

Upstream commit: http://git.kernel.org/linus/1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72

The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONEIO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.

The bufferslowrealign function in HAProxy 1.5.x before 1.5.14 and 1.6-dev does not properly realign a buffer that is used for pending outgoing data, which allows remote attackers to obtain sensitive information (uninitialized memory contents of previous requests) via a crafted request.