o CVE-2022-2031:  Samba AD users can bypass certain restrictions associated with
                  changing passwords.
                  https://www.samba.org/samba/security/CVE-2022-2031.html

o CVE-2022-32744: Samba AD users can forge password change requests for any user.
                  https://www.samba.org/samba/security/CVE-2022-32744.html

o CVE-2022-32745: Samba AD users can crash the server process with an LDAP add
                  or modify request.
                  https://www.samba.org/samba/security/CVE-2022-32745.html

o CVE-2022-32746: Samba AD users can induce a use-after-free in the server
                  process with an LDAP add or modify request.
                  https://www.samba.org/samba/security/CVE-2022-32746.html

o CVE-2022-32742: Server memory information leak via SMB1.
                  https://www.samba.org/samba/security/CVE-2022-32742.html

Use After Free in GitHub repository vim/vim prior to 9.0.0212

Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0211

Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0210

libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. 
An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop 
on it with certain parameters) could cause a crash or in some cases, further exploitation.

libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read 
and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop.

libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the 
extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger 
this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this 
flaw could cause a crash or potentially further exploitation.

Use After Free in GitHub repository vim/vim prior to 9.0.0224

Use After Free in GitHub repository vim/vim prior to 9.0.0245

NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240

In GNU Binutils before 2.4.0, there is a heap-buffer-overflow in the error function bfd_getl32 
when called from the strip_main function in strip-new via a crafted file.

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials 
after installing a file. A local unprivileged user could use this flaw to exchange the original file with 
a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat 
from this vulnerability is to data confidentiality and integrity as well as system availability.

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw 
to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, 
potentially gaining root privileges. The highest threat from this vulnerability is to data 
confidentiality and integrity as well as system availability.

A vulnerability was found in SoX where a divide by  zero bug exists in wav.c:967, functon startread. 
With a crafted wav file, the application crashes.

A vulnerability was found in SoX,  where a divide by zero exists in voc.c:334, functon read_samples.

A vulnerability was found in SoX, where a heap overflow was found in hcom.c:161, function startread. 
The vulnerability is exploitable with a crafted hcomn file.

A vulnerability was found in SoX, where a heap based overflow was found in  formats_i.c:376, function lsx_read_w_buf.

# using a git snapshot as 14.4.2 has many unfixed security vulns

Use After Free in GitHub repository vim/vim prior to 9.0.0286

A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker 
who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.