Last updated 26 August 2025

It was discovered that aufs improperly managed inode reference counts in the vfsubdentryopen() method. A local attacker could use this vulnerability to cause a denial of service attack.

A use-after-free flaw was found in fs/ext4/namei.c:dxinsertblock() and a BUG() in fs/ext4/ext4.h:2057, It is tested on 4.14 and 5.16, it randomly got segmentation faults in either systemd or other libc functions after the bug is triggered twice or more with below traces.

================================================================== [ 99.129641] BUG: KASAN: use-after-free in dxinsertblock+0xf9/0x1e0 [ 99.129678] Read of size 199528 at addr ffff88825d339028 by task tmp32/1078

[ 99.129729] CPU: 3 PID: 1078 Comm: tmp32 Not tainted 5.4.171 #1 [ 99.129730] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 99.129731] Call Trace: [ 99.129734] dumpstack+0x8b/0xb9 [ 99.129736] ? dxinsertblock+0xf9/0x1e0 [ 99.129739] printaddressdescription.constprop.4+0x23/0x400 [ 99.129740] ? dxinsertblock+0xf9/0x1e0 [ 99.129742] kasanreport+0x15c/0x1e0 [ 99.129743] ? dxinsertblock+0xf9/0x1e0 [ 99.129744] kasanreport+0x10/0x20 [ 99.129746] checkmemoryregion+0x149/0x1a0 [ 99.129747] memmove+0x1f/0x50 [ 99.129748] dxinsertblock+0xf9/0x1e0 [ 99.129750] dosplit+0x105b/0x1bf0 [ 99.129754] ? ext4renamedirfinish+0x820/0x820 [ 99.129755] ext4dxaddentry+0x30b/0x2a20 [ 99.129757] ? condresched+0x15/0x30 [ 99.129759] ? getblkgfp+0x35/0x7f0 [ 99.129760] ? adddirenttobuf+0x630/0x630 [ 99.129761] ? memset+0x1f/0x40 [ 99.129763] ? fscryptsetupfilename+0x32/0xce0 [ 99.129765] ? ext4getblk+0x127/0x3d0 [ 99.129766] ? dosyscall64+0x9a/0x390 [ 99.129768] ? entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129769] ? ext4iomapbegin+0xf10/0xf10 [ 99.129771] ? addtransactioncredits+0x13d/0xaf0 [ 99.129772] ? memset+0x1f/0x40 [ 99.129773] ? ext4fnamesetupfilename+0xd1/0x1f0 [ 99.129775] ? memset+0x1f/0x40 [ 99.129776] ext4addentry+0x6c7/0xcd0 [ 99.129778] ? makeindexeddir+0x1130/0x1130 [ 99.129779] ? jbd2journalgetwriteaccess+0xaf/0x120 [ 99.129781] ? ext4journalgetwriteaccess+0x41/0x70 [ 99.129782] ? jbd2journalstart+0x2d6/0x760 [ 99.129784] ext4rename+0xef9/0x1e00 [ 99.129786] ? avchaspermnoaudit+0x1b3/0x380 [ 99.129787] ? ext4tmpfile+0x3a0/0x3a0 [ 99.129788] ? avchasextendedperms+0xe80/0xe80 [ 99.129790] ? selinuxpathnotify+0x460/0x460 [ 99.129792] vfsrename+0x84f/0x1550 [ 99.129794] ? tomoyocredprepare+0xb1/0x160 [ 99.129795] ? vfsmkdir+0x5a0/0x5a0 [ 99.129796] ? dalloc+0x56/0x210 [ 99.129797] ? dorenameat2+0x78a/0x970 [ 99.129798] dorenameat2+0x78a/0x970 [ 99.129800] ? userpathcreate+0x30/0x30 [ 99.129801] ? lockrefputreturn+0xd7/0x190 [ 99.129803] ? blkpreruntimesuspend+0x280/0x280 [ 99.129804] ? kmemcachealloc+0x177/0x220 [ 99.129805] ? mntgetcount+0x1e0/0x1e0 [ 99.129806] ? dput+0x5a/0x760 [ 99.129808] ? pathsetxattr+0xb9/0x130 [ 99.129809] ? setxattr+0x240/0x240 [ 99.129810] ? fgetlight+0x55/0x1f0 [ 99.129811] ? fgetlight+0x55/0x1f0 [ 99.129813] x64sysrename+0x5a/0x80 [ 99.129814] dosyscall64+0x9a/0x390 [ 99.129815] ? prepareexittousermode+0xec/0x1a0 [ 99.129817] entrySYSCALL64afterhwframe+0x44/0xa9 [ 99.129819] RIP: 0033:0x7f8665863639

An information disclosure via path traversal was discovered in apport/hookutils.py function readfile(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Function checkattachmentforerrors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Last updated 14 August 2026

APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubuntu0.2; 2.0.2ubuntu0 versions prior to 2.0.2ubuntu0.2; 2.1.10ubuntu0 versions prior to 2.1.10ubuntu0.1;

An issue was discovered in domadvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORINGOPMADVISE implementation, aka CID-bc0c4d1e176e.

A flaw was found in containerd. Credentials may be leaked during an image pull.

Fixed bug (PHP parses encoded cookie names so malicious Host- cookies can be sent). (CVE-2020-7070)

Fixed bug (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)

A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets, bypassing security mechanisms, aka CID-26896f01467a.

An issue was discovered in the DBI module before 1.643 for Perl. The hvfetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.

A flaw was found in the Linux kernels sysctl handling code for hugepages management. When multiple root level processes would write to modify the /proc/sys/vm/nrhugepages file it could create a race on internal variables leading to a system crash or memory corruption.

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.

Last updated 25 August 2025

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

In BIND 9.0.0 -> 9.11.21, 9.12.0 -> 9.16.5, 9.17.0 -> 9.17.3, also affects 9.9.3-S1 -> 9.11.21-S1 of the BIND 9 Supported Preview Edition, An attacker on the network path for a TSIG-signed request, or operating the server receiving the TSIG-signed request, could send a truncated response to that request, triggering an assertion failure, causing the server to exit. Alternately, an off-path attacker would have to correctly guess when a TSIG-signed request was sent, along with other characteristics of the packet and message, and spoof a truncated response to trigger an assertion failure, causing the server to exit.

A buffer overflow vulnerability in GetNumSameData() in contrib/lips4/gdevlips.c of Artifex Software GhostScript from v9.18 to v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

A division by zero vulnerability in dot24printpage() in devices/gdevdm24.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

A buffer overflow vulnerability in lxm5700mprintpage() in devices/gdevlxm.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted eps file. This is fixed in v9.51.

A buffer overflow vulnerability in pprintimage() in devices/gdevcdj.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

A null pointer dereference vulnerability in devices/vector/gdevtxtw.c and psi/zbfont.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted postscript file. This is fixed in v9.51.

A buffer overflow vulnerability in imagerendercolorthresh() in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51.

A buffer overflow vulnerability in jetp3852printpage() in devices/gdev3852.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted PDF file. This is fixed in v9.51.

A buffer overflow vulnerability in okiibmprintpage1() in devices/gdevokii.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

A Division by Zero vulnerability in bj10vprintpage() in contrib/japanese/gdev10v.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.

A buffer overflow vulnerability in mjcolorcorrect() in contrib/japanese/gdevmjc.c of Artifex Software GhostScript v9.50 allows a remote attacker to cause a denial of service via a crafted PDF file. This is fixed in v9.51.