David Herrmann

**Name of the Vulnerable Software and Affected Versions** Eclipse RDF4J versions prior to 5.3.2 **Description** Several XML parser entry points do not fully restrict XML External Entity (XXE) processing when parsing untrusted XML-based RDF data or query results. This allows the use of DOCTYPE declarations, external entity references, and external DTD loading. XXE is a type of attack where an XML parser improperly handles external entity references within an XML document, potentially allowing access to unauthorized files or internal network resources. **Recommendations** Update to version 5.3.2.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.5 **Description** The issue allows local users to bypass file-descriptor limits, causing a denial of service due to memory consumption. This is achieved by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. **Recommendations** For versions prior to 4.5, update to version 4.5 or later to resolve the issue.