Anders Kaseorg

توجد مشكلة في التعقيد الخوارزمي في تحليل الروابط المضمنة. يمكن للمهاجمين عن بُعد استنفاد وحدة المعالجة المركزية (CPU) من خلال إرسال محتوى Markdown قصير يحتوي على أحرف `[` أو `![` مكررة. يؤدي ذلك إلى إجبار الدالتين `getText()` و `getLink()` داخل `LinkInlineProcessor` على إجراء عمليات مسح تربيعية، مما يبقي العاملين مشغولين لعدة دقائق.

The issue is related to the secure path feature in sudo, which does not properly handle an environment containing multiple PATH variables. This could allow local users to gain privileges via a crafted value of the last PATH variable. Multiple vulnerabilities in the sudo package may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker.

The issue involves multiple buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through various vectors, including a crafted zcrypt message related to zcrypt.c, and a reply command on a message with a Zephyr Cc: list, related to zwrite.c.

The issue affects the ndiswrapper package in Gentoo Linux and the Linux kernel 2.6, allowing remote attackers to execute arbitrary code by sending packets over a local wireless network with long ESSIDs, potentially compromising confidentiality, integrity, and availability of protected information.

The issue concerns multiple vulnerabilities in the afuse package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. Specifically, the expand template function in afuse.c is vulnerable to shell metacharacters in a pathname, allowing local users to gain privileges.