Last updated 25 August 2025

curl versions 7.54.1 through 7.60.0 are vulnerable to a heap-based buffer overflow in the Curlsmtpescapeeob() function when uploading data over SMTP and using a reduced read buffer. An attacker could exploit this by convincing a user to use curl to upload data over SMTP with a reduced buffer to cause a crash or corrupt memory.

Last updated 25 August 2025

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occuring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash.

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 25 August 2025

Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp.

curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.

An issue was discovered in Liblouis 3.5.0. A invalid free in the compileRule function in compileTranslationTable.c allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

Apache Tomcat through versions 7.0.88, 8.0.52, 8.5.31 and 9.0.8 have defaults settings for the CORS filter that are insecure and enable 'supportsCredentials' for all origins.

Upstream announcement:

https://lists.apache.org/thread.html/fbfb713e4f8a4c0f81089b89450828011343593800cae3fb629192b1@%3Cannounce.tomcat.apache.org%3E

Upstream bug:

https://bz.apache.org/bugzilla/showbug.cgi?id=62343

Upstream Patches:

http://svn.apache.org/viewvc?view=rev&rev=1831726 / trunk/9.0 http://svn.apache.org/viewvc?view=rev&rev=1831728 / 8.5 http://svn.apache.org/viewvc?view=rev&rev=1831729 / 8.0 http://svn.apache.org/viewvc?view=rev&rev=1831730 / 7.0

External References:

http://tomcat.apache.org/security-9.html#FixedinApacheTomcat9.0.9 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.5.32 http://tomcat.apache.org/security-8.html#FixedinApacheTomcat8.0.53 http://tomcat.apache.org/security-7.html#FixedinApacheTomcat7.0.89

An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes. This could lead to a potentially exploitable crash triggerable by web content.

A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in a potentially exploitable crash.

Last updated 25 August 2025

Last updated 25 August 2025

Last updated 25 August 2025

curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded content.

When servers send RTSP responses back to curl, the data starts out with a set of headers. curl parses that data to separate it into a number of headers to deal with those appropriately and to find the end of the headers that signal the start of the "body" part.

The function that splits up the response into headers is called Curlhttpreadwriteheaders() and in situations where it can't find a single header in the buffer, it might end up leaving a pointer pointing into the buffer instead of to the start of the buffer which then later on may lead to an out of buffer read when code assumes that pointer points to a full buffer size worth of memory to use.

This could potentially lead to information leakage but most likely a crash/denial of service for applications if a server triggers this flaw.

Introduced by following patches:

https://github.com/curl/curl/commit/b2ef79ef3d47b37 https://github.com/curl/curl/commit/bc4582b68a673d3

Affected versions: curl 7.20.0 to and including curl 7.59.0 Not affected versions: curl < 7.20.0 and curl >= 7.60.0

Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.

Affected versions:

Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier

External References:

https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash.

Last updated 25 August 2025

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.

A flaw was found in zsh prior 5.3.1. There was no check when copying to the internal xbuf2 for a preliminary test.

References: https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d

A flaw was found in zsh prior 5.0.7. There is a buffer overflow for very long fds in >& fd syntax.

References: https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055

A flaw was found in Perl 5. A heap write overflow in regcomp.c file might be exploited when a perl program allows user input of patterns. A crafted regular expression can cause the heap buffer overflow, with control over the bytes written.

apachemodphp. This issue was addressed by updating to php version 7.1.16.