Anders Kaseorg

Existe um problema de complexidade algorítmica no processamento de links inline. Atacantes remotos podem causar exaustão de CPU ao enviar conteúdo Markdown curto contendo caracteres `[` ou `![` repetidos. Isso força as funções `getText()` e `getLink()` dentro do `LinkInlineProcessor` a realizar varreduras quadráticas, o que pode manter os processos trabalhadores ocupados por vários minutos.

The issue is related to the secure path feature in sudo, which does not properly handle an environment containing multiple PATH variables. This could allow local users to gain privileges via a crafted value of the last PATH variable. Multiple vulnerabilities in the sudo package may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker.

The issue involves multiple buffer overflows that allow remote attackers to execute arbitrary code. This can be achieved through various vectors, including a crafted zcrypt message related to zcrypt.c, and a reply command on a message with a Zephyr Cc: list, related to zwrite.c.

The issue affects the ndiswrapper package in Gentoo Linux and the Linux kernel 2.6, allowing remote attackers to execute arbitrary code by sending packets over a local wireless network with long ESSIDs, potentially compromising confidentiality, integrity, and availability of protected information.

The issue concerns multiple vulnerabilities in the afuse package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. Specifically, the expand template function in afuse.c is vulnerable to shell metacharacters in a pathname, allowing local users to gain privileges.