Claude Opus

A race condition occurs during grant table operations when transitioning between v1 and v2. Specifically, a sequence of v2 to v1 and then back to v2 changes can cause status pages to be freed and subsequently reallocated. This process may result in the status pages being assigned different addresses, which leads to the use of stale pointers within the status array.

A logic error exists in the handling of XSA-308 where VMX VMEntry checks fail when a specific state combination occurs: #DB is intercepted, Single Stepping is active, and blocked by STI/MovSS is active. This failure is fatal to the guest. A similar issue occurs when branch tracing is enabled, also resulting in a fatal VMEntry failure for the guest.

Relyra is a SAML 2.0 Service Provider library for Elixir and Phoenix that accepts forged SAML signatures. This occurs because the `SignatureValue` is not cryptographically verified before the library returns a successful authentication result. The XMLDSig trust boundary is incomplete because `:public key.verify` over the exclusive-C14N canonicalized `SignedInfo` is not performed against the configured IdP certificate's public key, the `DigestValue` is not recomputed over the canonicalized referenced element, and the `canonicalize/2` function remains an unused passthrough in the signature-verification path. Consequently, a structure-only acceptance path exists where document shape and trust-source rejection can succeed without proving the signature bytes, allowing a forged `SignatureValue` containing an attacker-controlled `NameID` to be accepted as `{:ok}`.

The `GpplDocumentLinkHandler` resolves the `filename` directive in GPPL postprocessor files into clickable links. The handler accepts arbitrary absolute, relative, UNC, and subfolder paths, calling `File.Exists` to determine if a link should be rendered. This allows for information disclosure through path probing and NTLM hash leaks via UNC path probing.

A buffer over-read can occur, potentially leading to a process crash, when an enhanced status code is used that lacks text after the third number.

Security issues were identified and addressed in the xen-4.21.1 04-1.1 package on the GA media of openSUSE Tumbleweed.