Lua 5.3.5 has a use-after-free in luaupvaluejoin in lapi.c. For example a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.
It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property. In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.
An issue was discovered in LibVNCServer before 0.9.13. libvncserver/rfbregion.c has a NULL pointer dereference.
An issue was discovered in LibVNCServer before 0.9.13. libvncclient/tlsopenssl.c has a NULL pointer dereference.
An issue was discovered in LibVNCServer before 0.9.13. An improperly closed TCP connection causes an infinite loop in libvncclient/sockets.c.
In the Linux kernel before 4.20.12, net/ipv4/netfilter/nfnatsnmpbasicmain.c in the SNMP NAT module has insufficient ASN.1 length checks (aka an array index error), making out-of-bounds read and write operations possible, leading to an OOPS or local privilege escalation. This affects snmpversion and snmphelper.
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmimsghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.
A kernel memory leak was found in the kernelreadfile() function in the fs/exec.c file in the Linux kernel which allows attackers to cause a memory leak and thus a denial of service (DoS).
References:
https://lore.kernel.org/lkml/20190219021038.11340-1-yuehaibing@huawei.com/T/#u
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1935698.html
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f612acfae86af7ecad754ae6a46019be9da05b8e
In the Linux Kernel before versions 4.20.8 and 4.19.21 a use-after-free error in the "sctpsendmsg()" function (net/sctp/socket.c) when handling SCTPSENDALL flag can be exploited to corrupt memory.
In the Linux kernel afalgrelease() in crypto/afalg.c neglects to set a NULL value for a certain structure member, which leads to a use-after-free (UAF) in sockfssetattr.
A local attacker can use this flaw to escalate privileges and take control of the system. Other vendors have considered this a 'network' accessible attack, this claim is unsubstantiated at this time.
Note: The attack vector that allowed the use-after-free mentioned in the original report is not introduced in the Red Hat Enterprise Linux 7, 6 and 5 versions of the kernel.
References:
http://patchwork.ozlabs.org/patch/1042902/
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9060cb719e61b685ec0102574e10337fa5f445ea
A use after free issue was found in the way Linux kernel's KVM hypervisor emulates a preemption timer for L2 guest when nested(=1) virtualization is enabled. This high resolution timer(hrtimer) runs when L2 guest is active. After VM exit, in syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is free'd before calling syncvmcs12() routine.
A guest user/process could use this flaw to crash the host kernel resulting in DoS OR potentially gain privileged access to a system.
It affects only Intel processors and only when nested virtualization is enabled.
Upstream patch: --------------- -> https://git.kernel.org/linus/ecec76885bcfe3294685dc363fd1273df0d5d65f
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
A use after free issue was found in the way Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice(), device holds a reference to a VM object, latter this reference is transferred to caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to use-after-free issue latter.
A user/process could use this flaw to crash the guest VM resulting in DoS issue OR potentially gain privileged access to a system.
Upstream patch: --------------- -> https://git.kernel.org/linus/cfa39381173d5f969daf43582c95ad679189cbc9
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
Last updated 18 August 2025
Last updated 25 August 2025
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users.
Last updated 11 July 2025
In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox.
This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.formatmap method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the issafeattribute method on the sandbox and explicitly disallow the formatmap method on string objects.
A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
In LibTIFF 4.0.9, a heap-based buffer overflow occurs in the function LZWDecodeCompat in tiflzw.c via a crafted TIFF file, as demonstrated by tiff2ps.
GPAC through 0.7.1 has a Buffer Overflow in the gfmediaavcreadsps function in mediatools/avparsers.c, a different vulnerability than CVE-2018-1000100.
Last updated 24 July 2024
Last updated 25 August 2025
Last updated 18 August 2025
Last updated 11 July 2025
Last updated 11 July 2025
Last updated 25 August 2025
A flaw was found In the Linux kernel, through version 4.19.6, where a local user could exploit a use-after-free in the ALSA driver by supplying a malicious USB Sound device (with zero interfaces) that is mishandled in usbaudioprobe in sound/usb/card.c. An attacker could corrupt memory and possibly escalate privileges if the attacker is able to have physical access to the system.
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, mapwrite() in kernel/usernamespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAPSYSADMIN in an affected user namespace can bypass access controls on resources outside the namespace, as demonstrated by reading /etc/shadow. This occurs because an ID transformation takes place properly for the namespaced-to-kernel direction but not for the kernel-to-namespaced direction.
Last updated 25 August 2025