Ariadne Conill

The issue is related to the `pkgconf tuple parse` function in `libpkgconf/tuple.c`, which can cause an unbounded string expansion due to incorrect checks. This can lead to a denial of service when a specially crafted `.pc` file is used. For example, a `.pc` file containing a few hundred bytes can expand to one billion bytes.

A vulnerability in the Linux kernel has been resolved, related to the execution of commands with empty argv. The issue is described as forcing a single empty string when argv is empty.

The issue is related to the lack of input sanitization in the BusyBox command-line utility set, specifically affecting the netstat utility when printing DNS PTR records to a VT-compatible terminal. This could allow a remote attacker to execute arbitrary code or change the terminal's colors.

The issue is related to the mishandling of the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials because they may appear in SNI data or HTTP headers. This can enable a remote attacker to access confidential data.