A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
An information leakage issue was found in the way Linux kernel's KVM hypervisor handled page fault exception while emulating instructions like VMXON, VMCLEAR, VMPTRLD, VMWRITE with memory address as an operand. It occurs if the operand is an mmio address, as the returned exception object holds uninitialised stack memory contents.
A guest user/process could use this flaw to leak host's stack memory contents to a guest.
It affects only Intel processors and only when nested virtualization is enabled.
Upstream patch: --------------- -> https://git.kernel.org/linus/353c0956a618a07ba4bbe7ad00ff29fe70e8412a
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refreshprogressmeter() in progressmeter.c.
An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorizedkeys file).
A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister(MSR) access with nested(=1) virtualization enabled. In that, L1 guest could access L0's APIC register values via L2 guest, when 'virtualize x2APIC mode' is enabled.
A guest could use this flaw to potentially crash the host kernel resulting in DoS issue.
Upstream patches: ----------------- -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=acff78477b9b4f26ecdf65733a4ed77fe837e9dc -> https://git.kernel.org/pub/scm/virt/kvm/kvm.git/commit/?id=c73f4c998e1fd4249b9edfa39e23f4fda2b9b041
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/04/08/1
A flaw was found in the Linux kernel's implementation of Logical Link Control and Adaptation Protocol (L2CAP), part of the Bluetooth stack. An attacker, within the range of standard Bluetooth transmissions, can create and send a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.
A flaw was found in the Linux kernel's implementation of logical link control and adaptation protocol (L2CAP), part of the Bluetooth stack in the l2capparseconfrsp and l2capparseconfreq functions. An attacker with physical access within the range of standard Bluetooth transmission can create a specially crafted packet. The response to this specially crafted packet can contain part of the kernel stack which can be used in a further attack.
A flaw was found in the Linux kernel's implementation of ext4 extent management. The kernel doesn't correctly initialize memory regions in the extent tree block which may be exported to a local user to obtain sensitive information by reading empty/uninitialized data from the filesystem.
A flaw was found in the implementation of Intel Transactional Synchronization Extensions (TSX) abortion where a local authenticated attacker with the ability to monitor execution time is able to infer TSX memory state by comparing abort execution times.
This could allow information disclosure via this observed sidechannel for any TSX transaction being executed while an attacker is able to observe abort timing.
In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename.
Upstream Patch:
https://github.com/openssh/openssh-portable/commit/6010c030 https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/scp.c.diff?r1=1.197&r2=1.198&f=h
Last updated 25 August 2025
A flaw was found in PostgreSQL involving the pgcancelbackend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation requires a non-core extension with a less-resilient background worker and would affect that specific background worker only. This issue may allow a remote high privileged user to launch a denial of service (DoS) attack.
A flaw was found in grub2 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of UINT32MAX causes an arithmetic overflow, leading to a zero-sized memory allocation with a subsequent heap-based buffer overflow. The highest threat from this vulnerability is to integrity and system availability.
A flaw was found in grub2. An expected font value is not verified before proceeding with buffer allocations allowing an attacker to use a malicious font file to create an arithmetic overflow, zero-sized allocation, and further heap-based buffer overflow. The highest threat from this vulnerability is to data integrity and system availability.
Last updated 25 August 2025
In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32xlatetom in elf32xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because eblcorenote does not reject malformed core file notes.
References: https://sourceware.org/bugzilla/showbug.cgi?id=24089 https://sourceware.org/ml/elfutils-devel/2019-q1/msg00049.html
An issue was discovered in elfutils 0.175. A segmentation fault can occur in the function elf64xlatetom in libelf/elf32xlatetom.c, due to dwflsegmentreportmodule not checking whether the dyn data read from a core file is truncated. A crafted input can cause a program crash, leading to denial-of-service, as demonstrated by eu-stack.
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 18 August 2025
A flaw was found in the RMI registry implementation in the RMI component of OpenJDK. Incorrect handling of the server-side dispatch could lead to selection of an incorrect skeleton class.
Last updated 18 August 2025
Last updated 18 August 2025
Last updated 25 August 2025
Last updated 18 August 2025