Several vulnerabilities were discovered in libgd2, a library for
programmatic graphics creation and manipulation. A remote attacker can
take advantage of these flaws to cause a denial-of-service against an
application using the libgd2 library (application crash), or potentially
to execute arbitrary code with the privileges of the user running the
application.

Several vulnerabilities were found in PHP, a general-purpose scripting
language commonly used for web application development.

Two cross-site scripting vulnerabilities have been found in Horizon,
a web application to control an OpenStack cloud.

Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.

Multiple vulnerabilities were discovered in the dissectors/parsers for
PKTC, IAX2, GSM CBCH and NCP, SPOOLS, IEEE 802.11, UMTS FP, USB,
Toshiba, CoSine, NetScreen, WBXML which could result in denial of service
or potentially the execution of arbitrary code.

The TERASOLUNA Framework Development Team discovered a denial of service
vulnerability in Apache Commons FileUpload, a package to make it
easy to add robust, high-performance, file upload capability to servlets
and web applications. A remote attacker can take advantage of this flaw
by sending file upload requests that cause the HTTP server using the
Apache Commons Fileupload library to become unresponsive, preventing the
server from servicing other requests.

Vivian Zhang and Christoph Anton Mitterer discovered that setting an
empty VNC password does not work as documented in Libvirt, a
virtualisation abstraction library. When the password on a VNC server is
set to the empty string, authentication on the VNC server will be
disabled, allowing any user to connect, despite the documentation
declaring that setting an empty password for the VNC server prevents all
client connections. With this update the behaviour is enforced by
setting the password expiration to now.

Shmuel H discovered that GIMP, the GNU Image Manipulation Program, is
prone to a use-after-free vulnerability in the channel and layer
properties parsing process when loading a XCF file. An attacker can take
advantage of this flaw to potentially execute arbitrary code with the
privileges of the user running GIMP if a specially crafted XCF file is
processed.

The TERASOLUNA Framework Development Team discovered a denial of service
vulnerability in Apache Commons FileUpload, a package to make it
easy to add robust, high-performance, file upload capability to servlets
and web applications. A remote attacker can take advantage of this flaw
by sending file upload requests that cause the HTTP server using the
Apache Commons Fileupload library to become unresponsive, preventing the
server from servicing other requests.

Brandon Perry discovered that xerces-c, a validating XML parser library
for C++, fails to successfully parse a DTD that is deeply nested,
causing a stack overflow. A remote unauthenticated attacker can take
advantage of this flaw to cause a denial of service against applications
using the xerces-c library.