A vulnerability allowing to elevate privileges from the abrt user to root was reported. If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:

if (lastslash && strncmp(++lastslash, "abrt", 4) == 0) { / If abrtd/abrt-foo crashes, we don't want to create a directory, since that can make new copy of abrtd to process it, and maybe crash again... Unlike dirs, mere files are ignored by abrtd. / if (snprintf(path, sizeof(path), "%s/%s-coredump", gsettingsdumplocation, lastslash) >= sizeof(path)) errormsganddie("Error saving '%s': truncated long file path", path);

int abrtcorefd = xopen3(path, OWRONLY | OCREAT | OTRUNC, 0600);

The call to xopen3() does not include the flag ONOFOLLOW and is therefore vulnerable to a symlink attack.

This vulnerability is not exploitable on RHEL installations with default configuration. It can be exploitable if the system is configured to use non-RHN yum repositories. This is because yum is normally not usable by non-root users if the only configured repositories are RHN.

Note: This security flaw has been split from bug #1262252.

Last updated 25 August 2025

A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.

A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation.

The nftverdictinit() function allows positive values as drop error within the hook verdict, and hence the nfhookslow() function can cause a double free vulnerability when NFDROP is issued with a drop error which resembles NFACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

A vulnerability was discovered in Tomcat where if a servlet context was configured with readonly=false and HTTP PUT requests were allowed, an attacker could upload a JSP file to that context and achieve code execution.

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.

A flaw was found in the Linux kernels with commit b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) but without commit da029c11e6b1 ("exec:Limit arg stack to at most 75% of STKLIM", from July 7, 2017). An integer overflow in the Linux kernel's createelftables() function. A local attacker can exploit this vulnerability via a SUID-root binary and obtain full root privileges.

Referenced commits: b6a2fea39318 ("mm: variable length argument support", from July 19, 2007) https://github.com/torvalds/linux/commit/b6a2fea39318e43fee84fa7b0b90d68bed92d2ba

da029c11e6b1 ("exec: Limit arg stack to at most 75% of STKLIM", from July 7, 2017) https://github.com/torvalds/linux/commit/da029c11e6b12f321f36dac8771e833b65cec962

Additional references: https://www.qualys.com/2018/09/25/cve-2018-14634/mutagen-astronomy-integer-overflow-linux-createelftables-cve-2018-14634.txt

Artifex Ghostscript allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile.

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.

Moxilla Firefox allows remote attackers to bypass the Same Origin Policy to read arbitrary files or gain privileges.