A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
A Local Privilege Escalation vulnerability (from any user to root) was found in polkit's pkexec, a SUID-root program that is installed by default on every major Linux distribution.
A flaw was found in grub2 in versions prior to 2.06. Setparamprefix() in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in the input. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain commands with a large number of specific short forms of options. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A buffer overflow flaw was found in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs logged the buffer descriptors during migration. A privileged guest user able to pass descriptors with invalid length to the host when migration is underway, could use this flaw to increase their privileges on the host.
A vulnerability was found in the Linux kernel's Marvell WiFi chip driver. Where, while parsing vendor-specific informational attributes, an attacker on the same WiFi physical network segment could cause a system crash, resulting in a denial of service, or potentially execute arbitrary code. This flaw affects the network interface at the most basic level meaning the attacker only needs to affiliate with the same network device as the vulnerable system to create an attack path.
A flaw was discovered in the Bluetooth protocol. An attacker within physical proximity to the Bluetooth connection could downgrade the encryption protocol to be trivially brute forced.
Withdrawn Advisory This advisory has been withdrawn because the vulnerability only affects the Qpid Proton C library and not org.apache.qpid:proton-j. This link has been maintained to preserve external references.
Original Description
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.
A use after free issue was found in the way Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice(), device holds a reference to a VM object, latter this reference is transferred to caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to use-after-free issue latter.
A user/process could use this flaw to crash the guest VM resulting in DoS issue OR potentially gain privileged access to a system.
Upstream patch: --------------- -> https://git.kernel.org/linus/cfa39381173d5f969daf43582c95ad679189cbc9
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
A use after free issue was found in the way Linux kernel's KVM hypervisor emulates a preemption timer for L2 guest when nested(=1) virtualization is enabled. This high resolution timer(hrtimer) runs when L2 guest is active. After VM exit, in syncvmcs12() timer object is stopped. The use-after-free occurs if the timer object is free'd before calling syncvmcs12() routine.
A guest user/process could use this flaw to crash the host kernel resulting in DoS OR potentially gain privileged access to a system.
It affects only Intel processors and only when nested virtualization is enabled.
Upstream patch: --------------- -> https://git.kernel.org/linus/ecec76885bcfe3294685dc363fd1273df0d5d65f
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.
A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash.
In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types. A specially crafted PostScript document could exploit this to crash Ghostscript or, possibly, execute arbitrary code in the context of the Ghostscript process. This is a type confusion issue because of failure to check whether the Implementation of a pattern dictionary was a structure type.
A possible memory corruption due to a type confusion was found in the Linux kernel in the skclonelock() function in the net/core/sock.c. A possibility of local escalation of privileges cannot be fully ruled out for a local unprivileged attacker.
References:
https://source.android.com/security/bulletin/2018-12-01.html#kernel-components
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d538fa60bad4f7b23193c89e843797a1cf71ef3
A vulnerability was found in Artifex Ghostscript before 9.26. The restorepagedevice function in psi/zdevice2.c allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device remains the same.
References: https://bugs.ghostscript.com/showbug.cgi?id=700153 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patch: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3005fcb9bb160af199e761e03bc70a9f249a987e
A vulnerability was found in Artifex Ghostscript before 9.26. A type confusion in setcolorspace in psi/zicc.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700169 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=67d760ab775dae4efe803b5944b0439aa3c0b04a http://git.ghostscript.com/?p=ghostpdl.git;h=548bb434e81dadcc9f71adf891a3ef5bea8e2b4e
A vulnerability was found in Artifex Ghostscript before 9.26. A JBIG2Decode type confusion in psi/zfjbig2.c allows remote attackers to bypass intended access restrictions.
References: https://bugs.ghostscript.com/showbug.cgi?id=700168 https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26
Upstream Patches: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=ef252e7dc214bcbd9a2539216aab9202848602bb http://git.ghostscript.com/?p=ghostpdl.git;h=606a22e77e7f081781e99e44644cd0119f559e03
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion. This leads to a possible out-of-bounds write.
Note: 64-bit builds are not vulnerable to this issue.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-27/#CVE-2018-12393
Last updated 25 August 2025
A security flaw was found in the Linux kernel in the adjustscalarminmaxvals() function in kernel/bpf/verifier.c. A faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses because this function mishandles 32-bit right shifts. A local unprivileged user cannot leverage this flaw, but as a privileged user ("root") this can lead to a system panic and a denial of service or other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://bugs.chromium.org/p/project-zero/issues/detail?id=1686
https://seclists.org/oss-sec/2018/q4/69
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b799207e1e1816b09e7a5920fbb2d5fcf6edd681
A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator.
It was discovered that the JNDI comment of OpenJDK did not properly enforce the restriction controlled by the com.sun.jndi.ldap.object.trustURLCodebase system property. In certain cases, a Java LDAP client could unexpectedly load and execute code form an LDAP server.
It was discovered that the Hotspot component of OpenJDK did not perform access checks correctly in certain cases when performing field link resolution. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183.
Last updated 25 August 2025
A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered.