AppleKeyStore. A memory corruption issue was addressed with improved validation.
curl. An integer overflow existed in curl. This issue was addressed with improved bounds checking.
apache. Multiple issues were addressed by updating to version 2.4.27.
apache. Multiple issues were addressed by updating to version 2.4.27.
apache. Multiple issues were addressed by updating to version 2.4.27.
apachemodphp. This issue was addressed by updating to php version 7.1.16.
A flaw was found in Perl versions 5.8.0 through 5.28. An Integer overflow leading to buffer overflow in Perlmysetenv function in util.c
Upstream Patch: https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
A flaw was found in Perl 5. A heap write overflow in regcomp.c file might be exploited when a perl program allows user input of patterns. A crafted regular expression can cause the heap buffer overflow, with control over the bytes written.
tcpdump. Multiple issues were addressed by updating to version 4.9.2.
tcpdump. Multiple issues were addressed by updating to version 4.9.2.
Last updated 25 August 2025
It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module.
Last updated 25 August 2025
apache. Multiple issues were addressed by updating to version 2.4.27.
Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.
Affected versions:
Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier
External References:
https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
A flaw was found in Perl versions 5.22 through 5.26. Heap-buffer-overflow read in regcomp.c
Upstream Patch: https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62
Last updated 25 August 2025
A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file.
A heap overflow flaw was found in the libxml2 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=722079
External References:
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
apache. Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25.
A flaw was discovered in the Bluetooth protocol. An attacker within physical proximity to the Bluetooth connection could downgrade the encryption protocol to be trivially brute forced.
Last updated 25 August 2025
Last updated 25 August 2025
Security. A use after free issue was addressed with improved memory management.
It was found that Berkeley DB reads the DBCONFIG configuration file from the current working directory by default. This happens when calling dbcreate() with dbenv=NULL; or using the dbmopen() function.
References:
http://seclists.org/oss-sec/2017/q2/452 http://www.postfix.org/announcements/postfix-3.2.2.html
Proposed patch:
http://seclists.org/oss-sec/2017/q2/475
A flaw was found in the way the Linux kernel handled exceptions delivered after a stack switch operation via Mov SS or Pop SS instructions. During the stack switch operation, processor does not deliver interrupts and exceptions, they are delivered once the first instruction after the stack switch is executed.
An unprivileged system user could use this flaw to crash the system kernel resulting in DoS.
Upstream patch: --------------- -> https://git.kernel.org/linus/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2018/05/08/4
An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "Quick Look" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory consumption) via a crafted Office document.
CUPS. An issue existed in CUPS. This issue was addressed with improved access restrictions.
curl. An out-of-bounds read issue existed in the FTP PWD response parsing. This issue was addressed with improved bounds checking.
apache. Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25.