A use after free issue was found in the way Linux kernel's KVM hypervisor emulates a preemption timer for L2 guest when nested(=1) virtualization is enabled. This high resolution timer(hrtimer) runs when L2 guest is active. After VM exit, in syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is free'd before calling syncvmcs12() routine.
A guest user/process could use this flaw to crash the host kernel resulting in DoS OR potentially gain privileged access to a system.
It affects only Intel processors and only when nested virtualization is enabled.
Upstream patch: --------------- -> https://git.kernel.org/linus/ecec76885bcfe3294685dc363fd1273df0d5d65f
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
An infinite loop issue was found in the vhostnet kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handlerx(). It could occur if one end sends packets faster than the other end can process them. A guest user, maybe remote one, could use this flaw to stall the vhostnet kernel thread, resulting in a DoS scenario.
In Pallets Jinja before 2.10.1, str.formatmap allows a sandbox escape.
The sandbox is used to restrict what code can be evaluated when rendering untrusted, user-provided templates. Due to the way string formatting works in Python, the str.formatmap method could be used to escape the sandbox.
This issue was previously addressed for the str.format method in Jinja 2.8.1, which discusses the issue in detail. However, the less-common str.formatmap method was overlooked. This release applies the same sandboxing to both methods.
If you cannot upgrade Jinja, you can override the issafeattribute method on the sandbox and explicitly disallow the formatmap method on string objects.
A race condition was found in modauthdigest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the ifnametoindex() function.
A use-after-free vulnerability was found in libarchive in RAR decoder. A crafted archive could cause the application to crash.
Upstream issue:
https://github.com/libarchive/libarchive/pull/1105
Upstream patch:
https://github.com/libarchive/libarchive/commit/bfcfe6f04ed20db2504db8a254d1f40a1d84eb28
A double free vulnerability was found in libarchive in RAR decoder. A crafted archive could cause the application to crash.
Upstream issue:
https://github.com/libarchive/libarchive/pull/1105
Upstream patch:
https://github.com/libarchive/libarchive/pull/1105/commits/021efa522ad729ff0f5806c4ce53e4a6cc1daa31
Last updated 25 August 2025
Last updated 25 August 2025
Last updated 25 August 2025
Last updated 25 August 2025
Last updated 18 August 2025
In Poppler 0.73.0, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo.
Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.
embed/ephy-web-view.c in GNOME Web (aka Epiphany) through 3.31.4 allows address bar spoofing because a page load triggered by JavaScript leads to updating an address as if it were triggered by a safer visit type (e.g., VISITLINK, VISITTYPED, VISITBOOKMARK, or VISITHOMEPAGE).
Upstream issue: https://gitlab.gnome.org/GNOME/epiphany/issues/532
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later which can be triggered by certain post-handshake messages.
aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sensitive information by reading this file.
Last updated 25 August 2025
Catastrophic backtracking vulnerability was found in Python. Exploitation of a regular expression in difflib.ISLINEJUNK method in servers that use difflib can lead to denial of service.
Upstream issue:
https://bugs.python.org/issue32981
Catastrophic backtracking vulnerability was found in Python. Exploitation of a regular expression in pop3lib's apop() method although limited by 2048 chars, can lead to denial of service.
Upstream issue:
https://bugs.python.org/issue32981
Last updated 25 August 2025
A flaw was found in pacemaker. Insufficient verification of client-side authentication combined with other IPC weaknesses leads to local privilege escalation.
An issue was discovered in ListExt.c:XListExtensions and GetFPath.c:XGetFontPath in libX11 through version 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault).
References: http://www.openwall.com/lists/oss-security/2018/08/21/6 https://lists.x.org/archives/xorg-announce/2018-August/002916.html
Upstream Patch: https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=e83722768fd5c467ef61fa159e8c6278770b45c2
Last updated 25 August 2025