Robert Święcki

The issue is related to a double free vulnerability in the lib/x509/x509 ext.c component of GnuTLS. This vulnerability can be exploited by remote attackers using a crafted CRL distribution point, potentially leading to a denial of service or other unspecified impacts.

The issue allows local users to cause a denial of service or bypass the ASLR protection mechanism via a crafted application. This is due to the kernel's failure to properly handle private syscall numbers during use of the perf subsystem, leading to an out-of-bounds read and OOPS.

The issue concerns a problem where a program executes in a way that alters the relationship between the setuid system call and the getresuid saved set-user-ID value. This makes it easier for local users to gain privileges by exploiting a program that mistakenly expected it could permanently drop privileges. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information and can be exploited locally.

The issue allows remote attackers to inject arbitrary web script or HTML via a crafted name of a file or directory on a Gopher server, due to multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser.