It was discovered that the java-1.8.0-openjdk packages for Red Hat Enterprise Linux released via RHSA-2015:0809 (https://rhn.redhat.com/errata/RHSA-2015-0809.html) regressed the fix for the CVE-2015-0383 (bug 1123870) issue - "OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807)". This regression makes it possible to exploit the original issue and allow local attacker to make other users of OpenJDK 8 packages to overwrite arbitrary file via a symlink attack. Refer to bug 1123870 for technical details.

Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers to trigger unintended UI actions via a crafted web site that conducts a "tapjacking" attack.

The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

It was reported [1] that iptables can allow protocols that do not have a protocol handler kernel module loaded.

Given following iptables ruleset: -P FORWARD DROP -A FORWARD -m sctp --dport 9 -j ACCEPT -A FORWARD -p tcp --dport 80 -j ACCEPT -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT

One would assume that this allows SCTP on port 9 and TCP on port 80. Unfortunately, if the SCTP conntrack module is not loaded, this allows all SCTP communication to pass through, i.e. -p sctp -j ACCEPT

[1]: http://www.spinics.net/lists/netfilter-devel/msg33430.html