Tristan

The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re dfa add node (the NFA node table) and build range exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed. When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again. In regexec, the back-reference cache (match ctx add entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path. An attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common. The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure. An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process. This issue affects all architectures and ABIs supported by the GNU C Library.

O módulo RAOP aceita valores de Content-Length ilimitados e não verifica o valor de retorno da função `pw array add()`. Essa falta de validação pode levar a problemas de gerenciamento de memória ao processar requisições recebidas.

O servidor de protocolo PulseAudio contém múltiplas chamadas `alloca()` não limitadas. A função `alloca()` aloca memória na pilha e, quando essas chamadas não são limitadas, podem levar ao esgotamento da pilha.

The issue is an unauthenticated Cross-Site Scripting vulnerability. Any web service hosted on the same subdomain can set a cookie for the whole subdomain, which can be used to bypass other mitigations in place for malicious purposes.