Fixed bug (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)

Fixed bug (Buffer underflow in bcshiftaddsub). (CVE-2019-11046)

A vulnerability was found in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access.

Reference: https://bugs.php.net/bug.php?id=78863

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINABASE/webapps directory.

Last updated 25 August 2025

A vulnerability was found in PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata() function, it is possible for malicious data to cause PHP to read one byte of uninitialized memory. This could potentially lead to information disclosure or crash.

A new domain bypass transient execution attack known as Special Register Buffer Data Sampling (SRBDS) has been found. This flaw allows data values from special internal registers to be leaked by an attacker able to execute code on any core of the CPU. An unprivileged, local attacker can use this flaw to infer values returned by affected instructions known to be commonly used during cryptographic operations that rely on uniqueness, secrecy, or both.

In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task.

An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tifdirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. This is different from CVE-2018-12900.

An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exception while emulating instructions like VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory address as an operand. It occurs if the operand is an mmio address, as the returned exception object holds uninitialised stack memory contents.

A guest user/process could use this flaw to leak host's stack memory contents to a guest.

It affects only Intel processors and only when nested virtualization is enabled.

Upstream patch: --------------- -> https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a

Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

An unspecified error with the mishandling of pExpr->y.pTab in the sqlite3ExprCodeTarget function in expr.c in SQLite has an unknown impact and attack vector.

In SQLite through 3.29.0 whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlitestat1 sz field aka a "severe division by zero in the query planner."

A vulnerability was found in PHP EXIF extension is parsing EXIF information from an image, e.g. via exifreaddata() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash.

Reference: https://bugs.php.net/bug.php?id=78910

An issue was discovered in the fdlockedioctl function in drivers/block/floppy.c in the Linux kernel through 4.15.7. The floppy driver will copy a kernel pointer to user memory in response to the FDGETPRM ioctl. An attacker can send the FDGETPRM ioctl and use the obtained kernel pointer to discover the location of kernel code and data and bypass kernel security protections such as KASLR.

A NULL pointer dereference was found in net/rds/rdma.c:rdsrdmamap() function in the Linux kernel allowing local attackers to cause a system panic and a denial-of-service.

References:

https://patchwork.kernel.org/patch/10096441/

https://xorl.wordpress.com/2017/12/18/linux-kernel-rdma-null-pointer-dereference/

http://seclists.org/oss-sec/2018/q1/191

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f3069c6d33f6ae63a1668737bc78aaaa51bff7ca

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 4 July 2026

A flaw was found in php when creating a .phar file and configuring apache to handle phar files using php, when accessing invalid page the page name is reflected back to the user in the 404 response. This user input is not being sanitized and therefore it is vulnerable to a reflected XSS. Making, every site configured to run .phar files using php vulnerable.

References: https://bugs.php.net/bug.php?id=74782 https://bugs.php.net/bug.php?id=74782

Patch: https://gist.github.com/anonymous/70d2f6bac8db576d6386bd79c1e6e081

In the Linux kernel through 4.14.13, the rdscmsgatomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rdsatomicfreeop NULL pointer dereference.

An information leakage flaw is found in the way Linux kernel saves and restores Floating Point Unit(FPU) state during task switch. There are two ways, one is to save & restore FPU state during task context switch. And second is to defer FPU state save & restore until an FP instruction is invoked by the current task. First is called as "Eager FPU Restore" and second is known as "Lazy FPU Restore" scheme.

Linux kernel which follows the "Lazy FPU Restore" scheme is vulnerable to the FPU state information leakage issue. An unprivileged local attacker could use this flaw to read FPU state bits by conducting targeted cache side-channel attacks, similar to Meltdown attack disclosed earlier this year.

Upstream fix: ------------- -> https://git.kernel.org/linus//58122bf1d856a4ea9581d62a07c557d997d46a19

References: ----------- -> http://www.openwall.com/lists/oss-security/2018/06/13/7

An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization).

It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire).

As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

Versions Affected: httpd 2.0.1 to 2.4.29

External references:

https://httpd.apache.org/security/vulnerabilities24.html

A flaw was found in the latest Linux kernel. A out-of-bounds write of kernel address space may be triggered via uncontrolled userland provided offset in ebtentry struct in netfilter/ebtables.c.

References:

https://marc.info/?l=linux-netdev&m=152023808817590&w=2

https://marc.info/?l=linux-netdev&m=152025888924151&w=2

An upsteam patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b71812168571fa55e44cdd0254471331b9c4c4c6

https://github.com/torvalds/linux/commit/b71812168571fa55e44cdd0254471331b9c4c4c6

Last updated 4 July 2026

An issue was discovered in the Linux kernel through 4.19. An information leak in cdromioctlselectdisc in drivers/cdrom/cdrom.c could be used by local attackers to read kernel memory because a cast from unsigned long to int interferes with bounds checking. This is similar to CVE-2018-10940 and CVE-2018-16658.

In the Linux kernel before 4.17, a local attacker able to set attributes on an xfs filesystem could make this filesystem non-operational until the next mount by triggering an unchecked error condition during an xfs attribute change, because xfsattrshortformaddname in fs/xfs/libxfs/xfsattr.c mishandles ATTRREPLACE operations with conversion of an attr from short to long form.

An issue was discovered in the procpidstack function in fs/proc/base.c in the Linux kernel . An attacker with a local account can trick the stack unwinder code to leak stack contents to userspace. The fix allows only root may inspect the kernel stack of an arbitrary task.

Upstream patch:

https://marc.info/?l=linux-fsdevel&m=153806242024956&w=2

An information leak was discovered in the Linux kernel in cdromioctldrivestatus() function in drivers/cdrom/cdrom.c that could be used by local attackers to read kernel memory at certain location.

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f3fafc9c2f0ece10832c25f7ffcb07c97a32ad4